@open-mercato/ai-assistant 0.6.6-develop.6540.1.ae856df1ec → 0.6.6-develop.6541.1.c6f8fa5d2b

package/dist/modules/ai_assistant/api/settings/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/ai_assistant/api/settings/route.ts"],
-  "sourcesContent": ["import { createLogger } from '@open-mercato/shared/lib/logger'\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { llmProviderRegistry } from '@open-mercato/shared/lib/ai/llm-provider-registry'\nimport { joinProviderModel } from '@open-mercato/shared/lib/ai/model-id'\nimport {\n  OPEN_CODE_PROVIDER_IDS,\n  OPEN_CODE_PROVIDERS,\n  getOpenCodeProviderConfiguredEnvKey,\n  isOpenCodeProviderConfigured,\n} from '@open-mercato/shared/lib/ai/opencode-provider'\nimport { AiAgentRuntimeOverrideRepository, AiAgentRuntimeOverrideValidationError } from '../../data/repositories/AiAgentRuntimeOverrideRepository'\nimport { AiTenantModelAllowlistRepository } from '../../data/repositories/AiTenantModelAllowlistRepository'\nimport { isBaseurlAllowlisted, readBaseurlAllowlist } from '../../lib/baseurl-allowlist'\nimport { loadAgentRegistry, listAgents } from '../../lib/agent-registry'\nimport { createModelFactory, resolveAllowRuntimeOverride } from '../../lib/model-factory'\nimport {\n  agentOverrideModelAllowlistEnvVarName,\n  agentOverrideProviderAllowlistEnvVarName,\n  canonicalProviderId,\n  hasAllowlistSnapshotRestrictions,\n  intersectEffectiveAllowlistWithSnapshot,\n  intersectAllowlists,\n  isProviderAllowed,\n  isProviderAllowedInEffective,\n  isProviderModelAllowed,\n  isProviderModelAllowedInEffective,\n  modelAllowlistEnvVarName,\n  readAgentRuntimeOverrideAllowlist,\n  readAllowedModels,\n  readAllowedProviders,\n  readAllowlistConfig,\n  type TenantAllowlistSnapshot,\n} from '../../lib/model-allowlist'\n\nconst logger = createLogger('ai_assistant')\n\nfunction modelCatalogWithAllowlistFallback(\n  models: ReadonlyArray<{ id: string; name: string; contextWindow?: number | null; tags?: readonly string[] }>,\n  allowlistModelIds: string[] | undefined,\n): ReadonlyArray<{ id: string; name: string; contextWindow?: number | null; tags?: readonly string[] }> {\n  if (models.length > 0) return models\n  return (allowlistModelIds ?? []).map((id) => ({ id, name: id }))\n}\n\nconst runtimeOverrideUpsertSchema = z.object({\n  providerId: z.string().min(1).max(64).nullable().optional(),\n  modelId: z.string().min(1).max(256).nullable().optional(),\n  baseURL: z.string().url().max(2048).nullable().optional(),\n  agentId: z.string().min(1).max(128).nullable().optional(),\n  allowedOverrideProviders: z.array(z.string().min(1).max(64)).nullable().optional(),\n  allowedOverrideModelsByProvider: z\n    .record(z.string().min(1).max(64), z.array(z.string().min(1).max(256)))\n    .optional(),\n})\n\nconst runtimeOverrideClearSchema = z.object({\n  agentId: z.string().min(1).max(128).nullable().optional(),\n})\n\nexport type RuntimeOverrideUpsertBody = z.infer<typeof runtimeOverrideUpsertSchema>\nexport type RuntimeOverrideClearBody = z.infer<typeof runtimeOverrideClearSchema>\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'AI Assistant',\n  summary: 'AI assistant settings',\n  methods: {\n    GET: { summary: 'Get AI provider configuration' },\n    PUT: {\n      summary: 'Upsert per-tenant AI runtime override',\n      description:\n        'Creates or updates the per-tenant AI runtime override (provider, model, baseURL). ' +\n        'Optionally scoped to a specific agent via `agentId`. ' +\n        'Gated by `ai_assistant.settings.manage`. ' +\n        'baseURL must match AI_RUNTIME_BASEURL_ALLOWLIST when set.',\n      requestBody: {\n        contentType: 'application/json',\n        description: 'Override payload. All fields nullable/optional; null explicitly clears the axis.',\n        schema: runtimeOverrideUpsertSchema,\n      },\n      responses: [\n        { status: 200, description: 'Override saved. Returns the saved row.' },\n      ],\n      errors: [\n        { status: 400, description: 'Validation error: unknown provider, invalid URL, or baseURL not allowlisted.' },\n        { status: 401, description: 'Unauthenticated.' },\n        { status: 403, description: 'Caller lacks ai_assistant.settings.manage.' },\n      ],\n    },\n    DELETE: {\n      summary: 'Clear per-tenant AI runtime override',\n      description:\n        'Soft-deletes the active per-tenant runtime override. ' +\n        'Pass `agentId` to clear only the agent-specific row; omit to clear the tenant-wide default. ' +\n        'Gated by `ai_assistant.settings.manage`. Idempotent \u2014 returns 200 with `cleared: false` when no active row existed.',\n      requestBody: {\n        contentType: 'application/json',\n        description: 'Optional agentId to scope the delete.',\n        schema: runtimeOverrideClearSchema,\n      },\n      responses: [\n        { status: 200, description: 'Returns `{ cleared: boolean }` indicating whether a row was found and removed.' },\n      ],\n      errors: [\n        { status: 401, description: 'Unauthenticated.' },\n        { status: 403, description: 'Caller lacks ai_assistant.settings.manage.' },\n      ],\n    },\n  },\n}\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['ai_assistant.view'] },\n  PUT: { requireAuth: true, requireFeatures: ['ai_assistant.settings.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['ai_assistant.settings.manage'] },\n}\n\n/**\n * GET /api/ai_assistant/settings\n *\n * Returns the current OpenCode provider configuration from environment variables\n * plus the Phase 4a additive fields: resolvedDefault, tenantOverride, agents[],\n * and availableProviders[].defaultModels.\n */\nexport async function GET(req: NextRequest) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  try {\n    const env = process.env as Record<string, string | undefined>\n    const configuredProviderHint = env.OM_AI_PROVIDER?.trim() || env.OPENCODE_PROVIDER?.trim() || null\n    const registryProviders = llmProviderRegistry.list()\n    const knownProviderIdsForAllowlist: string[] = [\n      ...OPEN_CODE_PROVIDER_IDS,\n      ...registryProviders\n        .map((p) => p.id)\n        .filter((id) => !(OPEN_CODE_PROVIDER_IDS as readonly string[]).includes(id)),\n    ]\n    const registryProviderId = configuredProviderHint\n      ? canonicalProviderId(configuredProviderHint, registryProviders.map((provider) => provider.id))\n      : null\n    const registryProvider = registryProviderId ? llmProviderRegistry.get(registryProviderId) : null\n    const fallbackOpenCodeProviderId = (\n      (configuredProviderHint\n        ? canonicalProviderId(configuredProviderHint, OPEN_CODE_PROVIDER_IDS as readonly string[])\n        : null) ?? 'openai'\n    ) as keyof typeof OPEN_CODE_PROVIDERS\n    const fallbackOpenCodeProvider = OPEN_CODE_PROVIDERS[fallbackOpenCodeProviderId]\n\n    const providerId = registryProvider?.id ?? fallbackOpenCodeProviderId\n    const providerName = registryProvider?.name ?? fallbackOpenCodeProvider?.name ?? providerId\n    const defaultProviderModel = registryProvider?.defaultModel ?? fallbackOpenCodeProvider?.defaultModel ?? ''\n    const configuredModelHint = env.OM_AI_MODEL?.trim() || env.OPENCODE_MODEL?.trim() || defaultProviderModel\n    const fallbackModelWithProvider = joinProviderModel(providerId, configuredModelHint)\n    const apiKeyConfigured = registryProvider\n      ? registryProvider.isConfigured(env)\n      : fallbackOpenCodeProvider\n        ? isOpenCodeProviderConfigured(fallbackOpenCodeProviderId)\n        : false\n    const displayEnvKey = registryProvider\n      ? registryProvider.getConfiguredEnvKey(env)\n      : fallbackOpenCodeProvider\n        ? getOpenCodeProviderConfiguredEnvKey(fallbackOpenCodeProviderId)\n        : null\n\n    // Check if MCP_SERVER_API_KEY is configured (required for MCP authentication)\n    const mcpKeyConfigured = !!process.env.MCP_SERVER_API_KEY?.trim()\n\n    // Phase 4a: resolve tenant override row and per-agent resolution matrix\n    let tenantOverride: {\n      providerId: string | null\n      modelId: string | null\n      baseURL: string | null\n      agentId: string | null\n      updatedAt: string\n    } | null = null\n\n    let agentResolutions: Array<{\n      agentId: string\n      moduleId: string\n      allowRuntimeOverride: boolean\n      allowRuntimeModelOverride: boolean\n      codeDefaultProviderId: string | null\n      codeDefaultModelId: string | null\n      override: {\n        providerId: string | null\n        modelId: string | null\n        baseURL: string | null\n        updatedAt: string\n      } | null\n      runtimeOverrideAllowlist: {\n        env: TenantAllowlistSnapshot | null\n        tenant: TenantAllowlistSnapshot | null\n        effective: ReturnType<typeof intersectAllowlists>\n        envVarNames: {\n          providers: string\n          modelsByProvider: Record<string, string>\n        }\n      }\n      providerId: string\n      modelId: string\n      baseURL: string | null\n      source: string\n    }> = []\n\n    let resolvedDefault: {\n      providerId: string\n      modelId: string\n      baseURL: string | null\n      source: string\n    } | null = null\n\n    let tenantAllowlistSnapshot: TenantAllowlistSnapshot | null = null\n\n    try {\n      const container = await createRequestContainer()\n      const tenantId = auth.tenantId ?? null\n      const organizationId = auth.orgId ?? null\n\n      if (tenantId) {\n        const em = container.resolve<EntityManager>('em')\n        const repo = new AiAgentRuntimeOverrideRepository(em)\n        const overrideRow = await repo.getDefault({ tenantId, organizationId, agentId: null })\n        if (overrideRow) {\n          tenantOverride = {\n            providerId: overrideRow.providerId ?? null,\n            modelId: overrideRow.modelId ?? null,\n            baseURL: overrideRow.baseUrl ?? null,\n            agentId: overrideRow.agentId ?? null,\n            updatedAt: overrideRow.updatedAt.toISOString(),\n          }\n        }\n\n        const allowlistRepo = new AiTenantModelAllowlistRepository(em)\n        tenantAllowlistSnapshot = await allowlistRepo.getSnapshot({\n          tenantId,\n          organizationId,\n        })\n\n        const factory = createModelFactory(container)\n        const defaultResolution = factory.resolveModel({\n          tenantAllowlist: tenantAllowlistSnapshot,\n          tenantOverride: tenantOverride\n            ? { providerId: tenantOverride.providerId, modelId: tenantOverride.modelId, baseURL: tenantOverride.baseURL }\n            : undefined,\n        })\n        resolvedDefault = {\n          providerId: defaultResolution.providerId,\n          modelId: defaultResolution.modelId,\n          baseURL: defaultResolution.baseURL ?? null,\n          source: defaultResolution.source,\n        }\n\n        await loadAgentRegistry()\n        const agents = listAgents()\n        const agentResolutionPromises = agents.map(async (agent) => {\n          const agentOverrideRow = await repo.getExact({\n            tenantId,\n            organizationId,\n            agentId: agent.id,\n          })\n          const agentTenantOverride = agentOverrideRow\n            ? {\n                providerId: agentOverrideRow.providerId ?? null,\n                modelId: agentOverrideRow.modelId ?? null,\n                baseURL: agentOverrideRow.baseUrl ?? null,\n              }\n            : (tenantOverride ?? undefined)\n          const agentResolution = factory.resolveModel({\n            moduleId: agent.moduleId,\n            agentDefaultModel: agent.defaultModel,\n            agentDefaultProvider: agent.defaultProvider,\n            agentDefaultBaseUrl: agent.defaultBaseUrl,\n            allowRuntimeOverride: resolveAllowRuntimeOverride(agent),\n            tenantOverride: agentTenantOverride,\n            tenantAllowlist: tenantAllowlistSnapshot,\n          })\n          const agentEnvAllowlist = readAgentRuntimeOverrideAllowlist(\n            env,\n            agent.id,\n            knownProviderIdsForAllowlist,\n          )\n          const agentTenantAllowlist = agentOverrideRow\n            ? {\n                allowedProviders: agentOverrideRow.allowedOverrideProviders ?? null,\n                allowedModelsByProvider: agentOverrideRow.allowedOverrideModelsByProvider ?? {},\n              }\n            : null\n          const baseEffectiveAllowlist = intersectAllowlists(\n            env,\n            knownProviderIdsForAllowlist,\n            tenantAllowlistSnapshot,\n          )\n          const agentEffectiveAllowlist = intersectEffectiveAllowlistWithSnapshot(\n            intersectEffectiveAllowlistWithSnapshot(\n              baseEffectiveAllowlist,\n              knownProviderIdsForAllowlist,\n              agentEnvAllowlist,\n            ),\n            knownProviderIdsForAllowlist,\n            agentTenantAllowlist,\n          )\n          const agentModelEnvVars = Object.fromEntries(\n            knownProviderIdsForAllowlist.map((providerId) => [\n              providerId,\n              agentOverrideModelAllowlistEnvVarName(agent.id, providerId),\n            ]),\n          )\n          return {\n            agentId: agent.id,\n            moduleId: agent.moduleId,\n            allowRuntimeOverride: resolveAllowRuntimeOverride(agent),\n            allowRuntimeModelOverride: resolveAllowRuntimeOverride(agent),\n            codeDefaultProviderId: agent.defaultProvider ?? null,\n            codeDefaultModelId: agent.defaultModel ?? null,\n            override: agentOverrideRow\n              ? {\n                  providerId: agentOverrideRow.providerId ?? null,\n                  modelId: agentOverrideRow.modelId ?? null,\n                  baseURL: agentOverrideRow.baseUrl ?? null,\n                  updatedAt: agentOverrideRow.updatedAt.toISOString(),\n                }\n              : null,\n            runtimeOverrideAllowlist: {\n              env: agentEnvAllowlist,\n              tenant: hasAllowlistSnapshotRestrictions(agentTenantAllowlist)\n                ? agentTenantAllowlist\n                : null,\n              effective: agentEffectiveAllowlist,\n              envVarNames: {\n                providers: agentOverrideProviderAllowlistEnvVarName(agent.id),\n                modelsByProvider: agentModelEnvVars,\n              },\n            },\n            providerId: agentResolution.providerId,\n            modelId: agentResolution.modelId,\n            baseURL: agentResolution.baseURL ?? null,\n            source: agentResolution.source,\n          }\n        })\n        agentResolutions = await Promise.all(agentResolutionPromises)\n      }\n    } catch (overrideError) {\n      // Phase 4a fields are best-effort \u2014 log and continue returning the base response\n      logger.warn('AI Settings \u2014 Failed to compute Phase 4a override fields', { err: overrideError })\n    }\n\n    // Build availableProviders with Phase 4a defaultModels, then clip to the\n    // EFFECTIVE allowlist \u2014 env intersected with the per-tenant snapshot.\n    // The env allowlist is the OUTER constraint; the tenant allowlist (Phase\n    // 1780-6) narrows it further. The settings UI must never offer a value\n    // the runtime would refuse to honor.\n    const allowlistConfig = readAllowlistConfig(env, knownProviderIdsForAllowlist)\n    const effectiveAllowlist = intersectAllowlists(\n      env,\n      knownProviderIdsForAllowlist,\n      tenantAllowlistSnapshot,\n    )\n\n    const allRawProviders = [\n      ...OPEN_CODE_PROVIDER_IDS.map((id) => {\n        const info = OPEN_CODE_PROVIDERS[id]\n        const registryProvider = llmProviderRegistry.get(id)\n        return {\n          id,\n          name: info.name,\n          defaultModel: info.defaultModel,\n          envKey: getOpenCodeProviderConfiguredEnvKey(id),\n          configured: isOpenCodeProviderConfigured(id),\n          defaultModels: registryProvider?.defaultModels ?? [],\n        }\n      }),\n      // Also surface any llmProviderRegistry providers not in OPEN_CODE_PROVIDER_IDS\n      ...llmProviderRegistry.list()\n        .filter((p) => !(OPEN_CODE_PROVIDER_IDS as readonly string[]).includes(p.id))\n        .map((p) => ({\n          id: p.id,\n          name: p.name,\n          defaultModel: p.defaultModels[0]?.id ?? '',\n          envKey: null,\n          configured: p.isConfigured(),\n          defaultModels: p.defaultModels,\n        })),\n    ]\n\n    const availableProviders = allRawProviders\n      .filter((p) => isProviderAllowedInEffective(effectiveAllowlist, p.id))\n      .map((p) => {\n        const effectiveModelsList = effectiveAllowlist.modelsByProvider[p.id]\n        const catalogModels = modelCatalogWithAllowlistFallback(\n          p.defaultModels,\n          effectiveModelsList,\n        )\n        const clippedDefaults = effectiveModelsList !== undefined\n          ? catalogModels.filter((m) => effectiveModelsList.includes(m.id))\n          : catalogModels\n        return {\n          ...p,\n          defaultModel: effectiveModelsList && !effectiveModelsList.includes(p.defaultModel)\n            ? (effectiveModelsList[0] ?? p.defaultModel)\n            : p.defaultModel || clippedDefaults[0]?.id || '',\n          defaultModels: clippedDefaults,\n        }\n      })\n\n    const allowlistProviders = allRawProviders\n      .filter((p) => isProviderAllowed(env, p.id))\n      .map((p) => {\n        const envModelsList = allowlistConfig.modelsByProvider[p.id]\n        const catalogModels = modelCatalogWithAllowlistFallback(\n          p.defaultModels,\n          envModelsList,\n        )\n        const envClippedDefaults = envModelsList !== undefined\n          ? catalogModels.filter((m) => envModelsList.includes(m.id))\n          : catalogModels\n        return {\n          ...p,\n          defaultModel: envModelsList && !envModelsList.includes(p.defaultModel)\n            ? (envModelsList[0] ?? p.defaultModel)\n            : p.defaultModel || envClippedDefaults[0]?.id || '',\n          defaultModels: envClippedDefaults,\n        }\n      })\n\n    return NextResponse.json({\n      provider: {\n        id: providerId,\n        name: providerName,\n        model: resolvedDefault\n          ? joinProviderModel(resolvedDefault.providerId, resolvedDefault.modelId)\n          : fallbackModelWithProvider,\n        defaultModel: defaultProviderModel,\n        envKey: displayEnvKey,\n        configured: apiKeyConfigured,\n      },\n      availableProviders,\n      // Editable universe for the tenant allowlist page. This is clipped only\n      // by env so tenant-hidden models remain visible and can be re-enabled.\n      allowlistProviders,\n      // Snapshot of the env-driven allowlist so the UI can render hints like\n      // \"limited to: openai, anthropic\" without re-implementing the parser.\n      allowlist: allowlistConfig,\n      // Per-tenant allowlist snapshot (Phase 1780-6). `null` when no row has\n      // been persisted yet \u2014 the runtime then falls back to env-only\n      // enforcement. The UI uses this to drive the editable MultiSelect.\n      tenantAllowlist: tenantAllowlistSnapshot,\n      // Effective allowlist after intersecting env with tenant. The UI uses\n      // this to render the \"what the runtime will actually accept\" summary\n      // and to clip pickers without re-implementing the intersection.\n      effectiveAllowlist,\n      mcpKeyConfigured,\n      resolvedDefault,\n      tenantOverride,\n      agents: agentResolutions,\n    })\n  } catch (error) {\n    logger.error('AI Settings \u2014 GET error', { err: error })\n    return NextResponse.json({ error: 'Failed to fetch settings' }, { status: 500 })\n  }\n}\n\n/**\n * PUT /api/ai_assistant/settings\n *\n * Upserts the per-tenant AI runtime override (Phase 4a). Requires\n * `ai_assistant.settings.manage`. The body is Zod-validated; a `baseURL`\n * must match `AI_RUNTIME_BASEURL_ALLOWLIST` when that env var is set.\n */\nexport async function PUT(req: NextRequest) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  let parsedBody: unknown\n  try {\n    parsedBody = await req.json()\n  } catch {\n    return NextResponse.json({ error: 'Request body must be valid JSON.', code: 'validation_error' }, { status: 400 })\n  }\n\n  const bodyResult = runtimeOverrideUpsertSchema.safeParse(parsedBody)\n  if (!bodyResult.success) {\n    return NextResponse.json(\n      { error: 'Invalid request body.', code: 'validation_error', issues: bodyResult.error.issues },\n      { status: 400 },\n    )\n  }\n\n  const { providerId: requestedProviderId, modelId, baseURL, agentId } = bodyResult.data\n  const knownProviderIdsForRequest = llmProviderRegistry.list().map((p) => p.id)\n  const providerId = requestedProviderId\n    ? canonicalProviderId(requestedProviderId, knownProviderIdsForRequest) ?? requestedProviderId\n    : requestedProviderId\n\n  if (baseURL && baseURL.trim().length > 0) {\n    const allowlist = readBaseurlAllowlist()\n    if (!isBaseurlAllowlisted(baseURL.trim(), allowlist)) {\n      return NextResponse.json(\n        {\n          error: `baseURL \"${baseURL}\" is not in AI_RUNTIME_BASEURL_ALLOWLIST.`,\n          code: 'baseurl_not_allowlisted',\n        },\n        { status: 400 },\n      )\n    }\n  }\n\n  const allowedOverrideProviders = bodyResult.data.allowedOverrideProviders === undefined\n    ? undefined\n    : bodyResult.data.allowedOverrideProviders?.map((id) =>\n        canonicalProviderId(id, knownProviderIdsForRequest) ?? id,\n      ) ?? null\n  const allowedOverrideModelsByProvider = bodyResult.data.allowedOverrideModelsByProvider === undefined\n    ? undefined\n    : Object.fromEntries(\n        Object.entries(bodyResult.data.allowedOverrideModelsByProvider ?? {}).map(([id, models]) => [\n          canonicalProviderId(id, knownProviderIdsForRequest) ?? id,\n          models,\n        ]),\n      )\n  const hasRuntimeOverrideAllowlistWrite =\n    allowedOverrideProviders !== undefined || allowedOverrideModelsByProvider !== undefined\n\n  // Env-driven provider/model allowlist (Phase 1780-5) intersected with the\n  // per-tenant allowlist (Phase 1780-6): the EFFECTIVE allowlist clips which\n  // (provider, model) pairs the runtime accepts. Reject settings PUT requests\n  // for pairs outside that effective set so the settings UI never persists a\n  // value the runtime would later refuse. Tenant-allowlist enforcement is\n  // best-effort here: if the snapshot lookup fails we fall back to env-only\n  // checks (the runtime still re-clips at resolution time).\n  let putEffectiveAllowlist: ReturnType<typeof intersectAllowlists> | null = null\n  if (providerId || hasRuntimeOverrideAllowlistWrite) {\n    try {\n      const previewContainer = await createRequestContainer()\n      const knownIdsForCheck = [\n        ...OPEN_CODE_PROVIDER_IDS,\n        ...llmProviderRegistry\n          .list()\n          .map((p) => p.id)\n          .filter((id) => !(OPEN_CODE_PROVIDER_IDS as readonly string[]).includes(id)),\n      ]\n      let snapshot: TenantAllowlistSnapshot | null = null\n      if (auth.tenantId) {\n        try {\n          const em = previewContainer.resolve<EntityManager>('em')\n          const allowlistRepo = new AiTenantModelAllowlistRepository(em)\n          snapshot = await allowlistRepo.getSnapshot({\n            tenantId: auth.tenantId,\n            organizationId: auth.orgId ?? null,\n          })\n        } catch {\n          snapshot = null\n        }\n      }\n      putEffectiveAllowlist = intersectAllowlists(\n        process.env as Record<string, string | undefined>,\n        knownIdsForCheck,\n        snapshot,\n      )\n    } catch {\n      putEffectiveAllowlist = null\n    }\n\n    if (providerId && putEffectiveAllowlist) {\n      if (!isProviderAllowedInEffective(putEffectiveAllowlist, providerId)) {\n        const source = putEffectiveAllowlist.tenantOverridesActive\n          ? 'the effective allowlist (env \u2229 tenant)'\n          : 'OM_AI_AVAILABLE_PROVIDERS'\n        return NextResponse.json(\n          {\n            error: `Provider \"${providerId}\" is not in ${source}.`,\n            code: 'provider_not_allowlisted',\n          },\n          { status: 400 },\n        )\n      }\n      if (modelId && !isProviderModelAllowedInEffective(putEffectiveAllowlist, providerId, modelId)) {\n        const source = putEffectiveAllowlist.tenantOverridesActive\n          ? `the effective allowlist (env \u2229 tenant) for \"${providerId}\"`\n          : modelAllowlistEnvVarName(providerId)\n        return NextResponse.json(\n          {\n            error: `Model \"${modelId}\" is not in ${source}.`,\n            code: 'model_not_allowlisted',\n          },\n          { status: 400 },\n        )\n      }\n    } else if (providerId) {\n      if (!isProviderAllowed(process.env, providerId)) {\n        return NextResponse.json(\n          {\n            error: `Provider \"${requestedProviderId}\" is not in OM_AI_AVAILABLE_PROVIDERS.`,\n            code: 'provider_not_allowlisted',\n          },\n          { status: 400 },\n        )\n      }\n      if (modelId && !isProviderModelAllowed(process.env, providerId, modelId)) {\n        return NextResponse.json(\n          {\n            error: `Model \"${modelId}\" is not in ${modelAllowlistEnvVarName(providerId)}.`,\n            code: 'model_not_allowlisted',\n          },\n          { status: 400 },\n        )\n      }\n    }\n  }\n\n  if (hasRuntimeOverrideAllowlistWrite && !agentId) {\n    return NextResponse.json(\n      {\n        error: 'agentId is required when saving chat override allowlist settings.',\n        code: 'agent_required',\n      },\n      { status: 400 },\n    )\n  }\n\n  if (Array.isArray(allowedOverrideProviders)) {\n    for (const id of allowedOverrideProviders) {\n      if (putEffectiveAllowlist && !isProviderAllowedInEffective(putEffectiveAllowlist, id)) {\n        return NextResponse.json(\n          {\n            error: `Provider \"${id}\" is not in the effective tenant allowlist; per-agent chat override choices may not widen it.`,\n            code: 'provider_not_allowlisted',\n          },\n          { status: 400 },\n        )\n      }\n    }\n  }\n  if (allowedOverrideModelsByProvider) {\n    for (const [id, models] of Object.entries(allowedOverrideModelsByProvider)) {\n      if (putEffectiveAllowlist && !isProviderAllowedInEffective(putEffectiveAllowlist, id)) {\n        return NextResponse.json(\n          {\n            error: `Provider \"${id}\" is not in the effective tenant allowlist; cannot save per-agent model choices for it.`,\n            code: 'provider_not_allowlisted',\n          },\n          { status: 400 },\n        )\n      }\n      for (const allowedModelId of models) {\n        if (\n          putEffectiveAllowlist &&\n          !isProviderModelAllowedInEffective(putEffectiveAllowlist, id, allowedModelId)\n        ) {\n          return NextResponse.json(\n            {\n              error: `Model \"${allowedModelId}\" is not in the effective tenant allowlist for \"${id}\".`,\n              code: 'model_not_allowlisted',\n            },\n            { status: 400 },\n          )\n        }\n      }\n    }\n  }\n\n  try {\n    const container = await createRequestContainer()\n    const rbacService = container.resolve<RbacService>('rbacService')\n    const acl = await rbacService.loadAcl(auth.sub, {\n      tenantId: auth.tenantId,\n      organizationId: auth.orgId,\n    })\n    const canManage = acl.isSuperAdmin || acl.features.includes('ai_assistant.settings.manage')\n    if (!canManage) {\n      return NextResponse.json({ error: 'Forbidden', code: 'forbidden' }, { status: 403 })\n    }\n\n    const em = container.resolve<EntityManager>('em')\n    const repo = new AiAgentRuntimeOverrideRepository(em)\n    const upsertInput = {\n      agentId: agentId ?? null,\n      ...(Object.prototype.hasOwnProperty.call(bodyResult.data, 'providerId')\n        ? { providerId: providerId ?? null }\n        : {}),\n      ...(Object.prototype.hasOwnProperty.call(bodyResult.data, 'modelId')\n        ? { modelId: modelId ?? null }\n        : {}),\n      ...(Object.prototype.hasOwnProperty.call(bodyResult.data, 'baseURL')\n        ? { baseURL: baseURL ?? null }\n        : {}),\n      ...(allowedOverrideProviders !== undefined\n        ? { allowedOverrideProviders }\n        : {}),\n      ...(allowedOverrideModelsByProvider !== undefined\n        ? { allowedOverrideModelsByProvider }\n        : {}),\n    }\n    const row = await repo.upsertDefault(\n      upsertInput,\n      { tenantId: auth.tenantId ?? '', organizationId: auth.orgId ?? null, userId: auth.sub },\n    )\n    return NextResponse.json({\n      id: row.id,\n      tenantId: row.tenantId,\n      organizationId: row.organizationId,\n      agentId: row.agentId,\n      providerId: row.providerId,\n      modelId: row.modelId,\n      baseURL: row.baseUrl,\n      allowedOverrideProviders: row.allowedOverrideProviders ?? null,\n      allowedOverrideModelsByProvider: row.allowedOverrideModelsByProvider ?? {},\n      updatedAt: row.updatedAt,\n    })\n  } catch (error) {\n    if (error instanceof AiAgentRuntimeOverrideValidationError) {\n      return NextResponse.json({ error: error.message, code: 'provider_unknown' }, { status: 400 })\n    }\n    logger.error('AI Settings \u2014 PUT error', { err: error })\n    return NextResponse.json({ error: 'Failed to save runtime override.' }, { status: 500 })\n  }\n}\n\n/**\n * DELETE /api/ai_assistant/settings\n *\n * Soft-deletes the active per-tenant AI runtime override (Phase 4a). Requires\n * `ai_assistant.settings.manage`. Pass `agentId` in the body to clear only\n * the agent-specific row; omit (or null) to clear the tenant-wide default.\n * Idempotent \u2014 returns `{ cleared: false }` when no active row was found.\n */\nexport async function DELETE(req: NextRequest) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  let parsedBody: unknown = {}\n  try {\n    parsedBody = await req.json()\n  } catch {\n    // Body is optional for DELETE \u2014 empty body is fine\n  }\n\n  const bodyResult = runtimeOverrideClearSchema.safeParse(parsedBody)\n  if (!bodyResult.success) {\n    return NextResponse.json(\n      { error: 'Invalid request body.', code: 'validation_error', issues: bodyResult.error.issues },\n      { status: 400 },\n    )\n  }\n\n  try {\n    const container = await createRequestContainer()\n    const rbacService = container.resolve<RbacService>('rbacService')\n    const acl = await rbacService.loadAcl(auth.sub, {\n      tenantId: auth.tenantId,\n      organizationId: auth.orgId,\n    })\n    const canManage = acl.isSuperAdmin || acl.features.includes('ai_assistant.settings.manage')\n    if (!canManage) {\n      return NextResponse.json({ error: 'Forbidden', code: 'forbidden' }, { status: 403 })\n    }\n\n    const em = container.resolve<EntityManager>('em')\n    const repo = new AiAgentRuntimeOverrideRepository(em)\n    const cleared = await repo.clearDefault({\n      tenantId: auth.tenantId ?? '',\n      organizationId: auth.orgId ?? null,\n      agentId: bodyResult.data.agentId ?? null,\n    })\n    return NextResponse.json({ cleared })\n  } catch (error) {\n    logger.error('AI Settings \u2014 DELETE error', { err: error })\n    return NextResponse.json({ error: 'Failed to clear runtime override.' }, { status: 500 })\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,oBAAsC;AAC/C,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAGvC,SAAS,2BAA2B;AACpC,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,kCAAkC,6CAA6C;AACxF,SAAS,wCAAwC;AACjD,SAAS,sBAAsB,4BAA4B;AAC3D,SAAS,mBAAmB,kBAAkB;AAC9C,SAAS,oBAAoB,mCAAmC;AAChE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAGA;AAAA,OAEK;AAEP,MAAM,SAAS,aAAa,cAAc;AAE1C,SAAS,kCACP,QACA,mBACsG;AACtG,MAAI,OAAO,SAAS,EAAG,QAAO;AAC9B,UAAQ,qBAAqB,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,MAAM,GAAG,EAAE;AACjE;AAEA,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EACxD,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACxD,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EACxD,0BAA0B,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACjF,iCAAiC,EAC9B,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,EACrE,SAAS;AACd,CAAC;AAED,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAC1D,CAAC;AAKM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK,EAAE,SAAS,gCAAgC;AAAA,IAChD,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MAIF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,yCAAyC;AAAA,MACvE;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,+EAA+E;AAAA,QAC3G,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,QAC/C,EAAE,QAAQ,KAAK,aAAa,6CAA6C;AAAA,MAC3E;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,MAGF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,iFAAiF;AAAA,MAC/G;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,QAC/C,EAAE,QAAQ,KAAK,aAAa,6CAA6C;AAAA,MAC3E;AAAA,IACF;AAAA,EACF;AACF;AAEO,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AAAA,EACjE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,8BAA8B,EAAE;AAAA,EAC5E,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,8BAA8B,EAAE;AACjF;AASA,eAAsB,IAAI,KAAkB;AAC1C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,MAAI;AACF,UAAM,MAAM,QAAQ;AACpB,UAAM,yBAAyB,IAAI,gBAAgB,KAAK,KAAK,IAAI,mBAAmB,KAAK,KAAK;AAC9F,UAAM,oBAAoB,oBAAoB,KAAK;AACnD,UAAM,+BAAyC;AAAA,MAC7C,GAAG;AAAA,MACH,GAAG,kBACA,IAAI,CAAC,MAAM,EAAE,EAAE,EACf,OAAO,CAAC,OAAO,CAAE,uBAA6C,SAAS,EAAE,CAAC;AAAA,IAC/E;AACA,UAAM,qBAAqB,yBACvB,oBAAoB,wBAAwB,kBAAkB,IAAI,CAAC,aAAa,SAAS,EAAE,CAAC,IAC5F;AACJ,UAAM,mBAAmB,qBAAqB,oBAAoB,IAAI,kBAAkB,IAAI;AAC5F,UAAM,8BACH,yBACG,oBAAoB,wBAAwB,sBAA2C,IACvF,SAAS;AAEf,UAAM,2BAA2B,oBAAoB,0BAA0B;AAE/E,UAAM,aAAa,kBAAkB,MAAM;AAC3C,UAAM,eAAe,kBAAkB,QAAQ,0BAA0B,QAAQ;AACjF,UAAM,uBAAuB,kBAAkB,gBAAgB,0BAA0B,gBAAgB;AACzG,UAAM,sBAAsB,IAAI,aAAa,KAAK,KAAK,IAAI,gBAAgB,KAAK,KAAK;AACrF,UAAM,4BAA4B,kBAAkB,YAAY,mBAAmB;AACnF,UAAM,mBAAmB,mBACrB,iBAAiB,aAAa,GAAG,IACjC,2BACE,6BAA6B,0BAA0B,IACvD;AACN,UAAM,gBAAgB,mBAClB,iBAAiB,oBAAoB,GAAG,IACxC,2BACE,oCAAoC,0BAA0B,IAC9D;AAGN,UAAM,mBAAmB,CAAC,CAAC,QAAQ,IAAI,oBAAoB,KAAK;AAGhE,QAAI,iBAMO;AAEX,QAAI,mBA0BC,CAAC;AAEN,QAAI,kBAKO;AAEX,QAAI,0BAA0D;AAE9D,QAAI;AACF,YAAM,YAAY,MAAM,uBAAuB;AAC/C,YAAM,WAAW,KAAK,YAAY;AAClC,YAAM,iBAAiB,KAAK,SAAS;AAErC,UAAI,UAAU;AACZ,cAAM,KAAK,UAAU,QAAuB,IAAI;AAChD,cAAM,OAAO,IAAI,iCAAiC,EAAE;AACpD,cAAM,cAAc,MAAM,KAAK,WAAW,EAAE,UAAU,gBAAgB,SAAS,KAAK,CAAC;AACrF,YAAI,aAAa;AACf,2BAAiB;AAAA,YACf,YAAY,YAAY,cAAc;AAAA,YACtC,SAAS,YAAY,WAAW;AAAA,YAChC,SAAS,YAAY,WAAW;AAAA,YAChC,SAAS,YAAY,WAAW;AAAA,YAChC,WAAW,YAAY,UAAU,YAAY;AAAA,UAC/C;AAAA,QACF;AAEA,cAAM,gBAAgB,IAAI,iCAAiC,EAAE;AAC7D,kCAA0B,MAAM,cAAc,YAAY;AAAA,UACxD;AAAA,UACA;AAAA,QACF,CAAC;AAED,cAAM,UAAU,mBAAmB,SAAS;AAC5C,cAAM,oBAAoB,QAAQ,aAAa;AAAA,UAC7C,iBAAiB;AAAA,UACjB,gBAAgB,iBACZ,EAAE,YAAY,eAAe,YAAY,SAAS,eAAe,SAAS,SAAS,eAAe,QAAQ,IAC1G;AAAA,QACN,CAAC;AACD,0BAAkB;AAAA,UAChB,YAAY,kBAAkB;AAAA,UAC9B,SAAS,kBAAkB;AAAA,UAC3B,SAAS,kBAAkB,WAAW;AAAA,UACtC,QAAQ,kBAAkB;AAAA,QAC5B;AAEA,cAAM,kBAAkB;AACxB,cAAM,SAAS,WAAW;AAC1B,cAAM,0BAA0B,OAAO,IAAI,OAAO,UAAU;AAC1D,gBAAM,mBAAmB,MAAM,KAAK,SAAS;AAAA,YAC3C;AAAA,YACA;AAAA,YACA,SAAS,MAAM;AAAA,UACjB,CAAC;AACD,gBAAM,sBAAsB,mBACxB;AAAA,YACE,YAAY,iBAAiB,cAAc;AAAA,YAC3C,SAAS,iBAAiB,WAAW;AAAA,YACrC,SAAS,iBAAiB,WAAW;AAAA,UACvC,IACC,kBAAkB;AACvB,gBAAM,kBAAkB,QAAQ,aAAa;AAAA,YAC3C,UAAU,MAAM;AAAA,YAChB,mBAAmB,MAAM;AAAA,YACzB,sBAAsB,MAAM;AAAA,YAC5B,qBAAqB,MAAM;AAAA,YAC3B,sBAAsB,4BAA4B,KAAK;AAAA,YACvD,gBAAgB;AAAA,YAChB,iBAAiB;AAAA,UACnB,CAAC;AACD,gBAAM,oBAAoB;AAAA,YACxB;AAAA,YACA,MAAM;AAAA,YACN;AAAA,UACF;AACA,gBAAM,uBAAuB,mBACzB;AAAA,YACE,kBAAkB,iBAAiB,4BAA4B;AAAA,YAC/D,yBAAyB,iBAAiB,mCAAmC,CAAC;AAAA,UAChF,IACA;AACJ,gBAAM,yBAAyB;AAAA,YAC7B;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACA,gBAAM,0BAA0B;AAAA,YAC9B;AAAA,cACE;AAAA,cACA;AAAA,cACA;AAAA,YACF;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACA,gBAAM,oBAAoB,OAAO;AAAA,YAC/B,6BAA6B,IAAI,CAACA,gBAAe;AAAA,cAC/CA;AAAA,cACA,sCAAsC,MAAM,IAAIA,WAAU;AAAA,YAC5D,CAAC;AAAA,UACH;AACA,iBAAO;AAAA,YACL,SAAS,MAAM;AAAA,YACf,UAAU,MAAM;AAAA,YAChB,sBAAsB,4BAA4B,KAAK;AAAA,YACvD,2BAA2B,4BAA4B,KAAK;AAAA,YAC5D,uBAAuB,MAAM,mBAAmB;AAAA,YAChD,oBAAoB,MAAM,gBAAgB;AAAA,YAC1C,UAAU,mBACN;AAAA,cACE,YAAY,iBAAiB,cAAc;AAAA,cAC3C,SAAS,iBAAiB,WAAW;AAAA,cACrC,SAAS,iBAAiB,WAAW;AAAA,cACrC,WAAW,iBAAiB,UAAU,YAAY;AAAA,YACpD,IACA;AAAA,YACJ,0BAA0B;AAAA,cACxB,KAAK;AAAA,cACL,QAAQ,iCAAiC,oBAAoB,IACzD,uBACA;AAAA,cACJ,WAAW;AAAA,cACX,aAAa;AAAA,gBACX,WAAW,yCAAyC,MAAM,EAAE;AAAA,gBAC5D,kBAAkB;AAAA,cACpB;AAAA,YACF;AAAA,YACA,YAAY,gBAAgB;AAAA,YAC5B,SAAS,gBAAgB;AAAA,YACzB,SAAS,gBAAgB,WAAW;AAAA,YACpC,QAAQ,gBAAgB;AAAA,UAC1B;AAAA,QACF,CAAC;AACD,2BAAmB,MAAM,QAAQ,IAAI,uBAAuB;AAAA,MAC9D;AAAA,IACF,SAAS,eAAe;AAEtB,aAAO,KAAK,iEAA4D,EAAE,KAAK,cAAc,CAAC;AAAA,IAChG;AAOA,UAAM,kBAAkB,oBAAoB,KAAK,4BAA4B;AAC7E,UAAM,qBAAqB;AAAA,MACzB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,UAAM,kBAAkB;AAAA,MACtB,GAAG,uBAAuB,IAAI,CAAC,OAAO;AACpC,cAAM,OAAO,oBAAoB,EAAE;AACnC,cAAMC,oBAAmB,oBAAoB,IAAI,EAAE;AACnD,eAAO;AAAA,UACL;AAAA,UACA,MAAM,KAAK;AAAA,UACX,cAAc,KAAK;AAAA,UACnB,QAAQ,oCAAoC,EAAE;AAAA,UAC9C,YAAY,6BAA6B,EAAE;AAAA,UAC3C,eAAeA,mBAAkB,iBAAiB,CAAC;AAAA,QACrD;AAAA,MACF,CAAC;AAAA;AAAA,MAED,GAAG,oBAAoB,KAAK,EACzB,OAAO,CAAC,MAAM,CAAE,uBAA6C,SAAS,EAAE,EAAE,CAAC,EAC3E,IAAI,CAAC,OAAO;AAAA,QACX,IAAI,EAAE;AAAA,QACN,MAAM,EAAE;AAAA,QACR,cAAc,EAAE,cAAc,CAAC,GAAG,MAAM;AAAA,QACxC,QAAQ;AAAA,QACR,YAAY,EAAE,aAAa;AAAA,QAC3B,eAAe,EAAE;AAAA,MACnB,EAAE;AAAA,IACN;AAEA,UAAM,qBAAqB,gBACxB,OAAO,CAAC,MAAM,6BAA6B,oBAAoB,EAAE,EAAE,CAAC,EACpE,IAAI,CAAC,MAAM;AACV,YAAM,sBAAsB,mBAAmB,iBAAiB,EAAE,EAAE;AACpE,YAAM,gBAAgB;AAAA,QACpB,EAAE;AAAA,QACF;AAAA,MACF;AACA,YAAM,kBAAkB,wBAAwB,SAC5C,cAAc,OAAO,CAAC,MAAM,oBAAoB,SAAS,EAAE,EAAE,CAAC,IAC9D;AACJ,aAAO;AAAA,QACL,GAAG;AAAA,QACH,cAAc,uBAAuB,CAAC,oBAAoB,SAAS,EAAE,YAAY,IAC5E,oBAAoB,CAAC,KAAK,EAAE,eAC7B,EAAE,gBAAgB,gBAAgB,CAAC,GAAG,MAAM;AAAA,QAChD,eAAe;AAAA,MACjB;AAAA,IACF,CAAC;AAEH,UAAM,qBAAqB,gBACxB,OAAO,CAAC,MAAM,kBAAkB,KAAK,EAAE,EAAE,CAAC,EAC1C,IAAI,CAAC,MAAM;AACV,YAAM,gBAAgB,gBAAgB,iBAAiB,EAAE,EAAE;AAC3D,YAAM,gBAAgB;AAAA,QACpB,EAAE;AAAA,QACF;AAAA,MACF;AACA,YAAM,qBAAqB,kBAAkB,SACzC,cAAc,OAAO,CAAC,MAAM,cAAc,SAAS,EAAE,EAAE,CAAC,IACxD;AACJ,aAAO;AAAA,QACL,GAAG;AAAA,QACH,cAAc,iBAAiB,CAAC,cAAc,SAAS,EAAE,YAAY,IAChE,cAAc,CAAC,KAAK,EAAE,eACvB,EAAE,gBAAgB,mBAAmB,CAAC,GAAG,MAAM;AAAA,QACnD,eAAe;AAAA,MACjB;AAAA,IACF,CAAC;AAEH,WAAO,aAAa,KAAK;AAAA,MACvB,UAAU;AAAA,QACR,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,OAAO,kBACH,kBAAkB,gBAAgB,YAAY,gBAAgB,OAAO,IACrE;AAAA,QACJ,cAAc;AAAA,QACd,QAAQ;AAAA,QACR,YAAY;AAAA,MACd;AAAA,MACA;AAAA;AAAA;AAAA,MAGA;AAAA;AAAA;AAAA,MAGA,WAAW;AAAA;AAAA;AAAA;AAAA,MAIX,iBAAiB;AAAA;AAAA;AAAA;AAAA,MAIjB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,IACV,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,gCAA2B,EAAE,KAAK,MAAM,CAAC;AACtD,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AACF;AASA,eAAsB,IAAI,KAAkB;AAC1C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,MAAI;AACJ,MAAI;AACF,iBAAa,MAAM,IAAI,KAAK;AAAA,EAC9B,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,MAAM,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnH;AAEA,QAAM,aAAa,4BAA4B,UAAU,UAAU;AACnE,MAAI,CAAC,WAAW,SAAS;AACvB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,yBAAyB,MAAM,oBAAoB,QAAQ,WAAW,MAAM,OAAO;AAAA,MAC5F,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,EAAE,YAAY,qBAAqB,SAAS,SAAS,QAAQ,IAAI,WAAW;AAClF,QAAM,6BAA6B,oBAAoB,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;AAC7E,QAAM,aAAa,sBACf,oBAAoB,qBAAqB,0BAA0B,KAAK,sBACxE;AAEJ,MAAI,WAAW,QAAQ,KAAK,EAAE,SAAS,GAAG;AACxC,UAAM,YAAY,qBAAqB;AACvC,QAAI,CAAC,qBAAqB,QAAQ,KAAK,GAAG,SAAS,GAAG;AACpD,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO,YAAY,OAAO;AAAA,UAC1B,MAAM;AAAA,QACR;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,2BAA2B,WAAW,KAAK,6BAA6B,SAC1E,SACA,WAAW,KAAK,0BAA0B;AAAA,IAAI,CAAC,OAC7C,oBAAoB,IAAI,0BAA0B,KAAK;AAAA,EACzD,KAAK;AACT,QAAM,kCAAkC,WAAW,KAAK,oCAAoC,SACxF,SACA,OAAO;AAAA,IACL,OAAO,QAAQ,WAAW,KAAK,mCAAmC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,MAAM,MAAM;AAAA,MAC1F,oBAAoB,IAAI,0BAA0B,KAAK;AAAA,MACvD;AAAA,IACF,CAAC;AAAA,EACH;AACJ,QAAM,mCACJ,6BAA6B,UAAa,oCAAoC;AAShF,MAAI,wBAAuE;AAC3E,MAAI,cAAc,kCAAkC;AAClD,QAAI;AACF,YAAM,mBAAmB,MAAM,uBAAuB;AACtD,YAAM,mBAAmB;AAAA,QACvB,GAAG;AAAA,QACH,GAAG,oBACA,KAAK,EACL,IAAI,CAAC,MAAM,EAAE,EAAE,EACf,OAAO,CAAC,OAAO,CAAE,uBAA6C,SAAS,EAAE,CAAC;AAAA,MAC/E;AACA,UAAI,WAA2C;AAC/C,UAAI,KAAK,UAAU;AACjB,YAAI;AACF,gBAAM,KAAK,iBAAiB,QAAuB,IAAI;AACvD,gBAAM,gBAAgB,IAAI,iCAAiC,EAAE;AAC7D,qBAAW,MAAM,cAAc,YAAY;AAAA,YACzC,UAAU,KAAK;AAAA,YACf,gBAAgB,KAAK,SAAS;AAAA,UAChC,CAAC;AAAA,QACH,QAAQ;AACN,qBAAW;AAAA,QACb;AAAA,MACF;AACA,8BAAwB;AAAA,QACtB,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF,QAAQ;AACN,8BAAwB;AAAA,IAC1B;AAEA,QAAI,cAAc,uBAAuB;AACvC,UAAI,CAAC,6BAA6B,uBAAuB,UAAU,GAAG;AACpE,cAAM,SAAS,sBAAsB,wBACjC,gDACA;AACJ,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,OAAO,aAAa,UAAU,eAAe,MAAM;AAAA,YACnD,MAAM;AAAA,UACR;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI,WAAW,CAAC,kCAAkC,uBAAuB,YAAY,OAAO,GAAG;AAC7F,cAAM,SAAS,sBAAsB,wBACjC,oDAA+C,UAAU,MACzD,yBAAyB,UAAU;AACvC,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,OAAO,UAAU,OAAO,eAAe,MAAM;AAAA,YAC7C,MAAM;AAAA,UACR;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF,WAAW,YAAY;AACrB,UAAI,CAAC,kBAAkB,QAAQ,KAAK,UAAU,GAAG;AAC/C,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,OAAO,aAAa,mBAAmB;AAAA,YACvC,MAAM;AAAA,UACR;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI,WAAW,CAAC,uBAAuB,QAAQ,KAAK,YAAY,OAAO,GAAG;AACxE,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,OAAO,UAAU,OAAO,eAAe,yBAAyB,UAAU,CAAC;AAAA,YAC3E,MAAM;AAAA,UACR;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,MAAI,oCAAoC,CAAC,SAAS;AAChD,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO;AAAA,QACP,MAAM;AAAA,MACR;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,MAAI,MAAM,QAAQ,wBAAwB,GAAG;AAC3C,eAAW,MAAM,0BAA0B;AACzC,UAAI,yBAAyB,CAAC,6BAA6B,uBAAuB,EAAE,GAAG;AACrF,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,OAAO,aAAa,EAAE;AAAA,YACtB,MAAM;AAAA,UACR;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,iCAAiC;AACnC,eAAW,CAAC,IAAI,MAAM,KAAK,OAAO,QAAQ,+BAA+B,GAAG;AAC1E,UAAI,yBAAyB,CAAC,6BAA6B,uBAAuB,EAAE,GAAG;AACrF,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,OAAO,aAAa,EAAE;AAAA,YACtB,MAAM;AAAA,UACR;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,iBAAW,kBAAkB,QAAQ;AACnC,YACE,yBACA,CAAC,kCAAkC,uBAAuB,IAAI,cAAc,GAC5E;AACA,iBAAO,aAAa;AAAA,YAClB;AAAA,cACE,OAAO,UAAU,cAAc,mDAAmD,EAAE;AAAA,cACpF,MAAM;AAAA,YACR;AAAA,YACA,EAAE,QAAQ,IAAI;AAAA,UAChB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,cAAc,UAAU,QAAqB,aAAa;AAChE,UAAM,MAAM,MAAM,YAAY,QAAQ,KAAK,KAAK;AAAA,MAC9C,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,IACvB,CAAC;AACD,UAAM,YAAY,IAAI,gBAAgB,IAAI,SAAS,SAAS,8BAA8B;AAC1F,QAAI,CAAC,WAAW;AACd,aAAO,aAAa,KAAK,EAAE,OAAO,aAAa,MAAM,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrF;AAEA,UAAM,KAAK,UAAU,QAAuB,IAAI;AAChD,UAAM,OAAO,IAAI,iCAAiC,EAAE;AACpD,UAAM,cAAc;AAAA,MAClB,SAAS,WAAW;AAAA,MACpB,GAAI,OAAO,UAAU,eAAe,KAAK,WAAW,MAAM,YAAY,IAClE,EAAE,YAAY,cAAc,KAAK,IACjC,CAAC;AAAA,MACL,GAAI,OAAO,UAAU,eAAe,KAAK,WAAW,MAAM,SAAS,IAC/D,EAAE,SAAS,WAAW,KAAK,IAC3B,CAAC;AAAA,MACL,GAAI,OAAO,UAAU,eAAe,KAAK,WAAW,MAAM,SAAS,IAC/D,EAAE,SAAS,WAAW,KAAK,IAC3B,CAAC;AAAA,MACL,GAAI,6BAA6B,SAC7B,EAAE,yBAAyB,IAC3B,CAAC;AAAA,MACL,GAAI,oCAAoC,SACpC,EAAE,gCAAgC,IAClC,CAAC;AAAA,IACP;AACA,UAAM,MAAM,MAAM,KAAK;AAAA,MACrB;AAAA,MACA,EAAE,UAAU,KAAK,YAAY,IAAI,gBAAgB,KAAK,SAAS,MAAM,QAAQ,KAAK,IAAI;AAAA,IACxF;AACA,WAAO,aAAa,KAAK;AAAA,MACvB,IAAI,IAAI;AAAA,MACR,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,MACpB,SAAS,IAAI;AAAA,MACb,YAAY,IAAI;AAAA,MAChB,SAAS,IAAI;AAAA,MACb,SAAS,IAAI;AAAA,MACb,0BAA0B,IAAI,4BAA4B;AAAA,MAC1D,iCAAiC,IAAI,mCAAmC,CAAC;AAAA,MACzE,WAAW,IAAI;AAAA,IACjB,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,iBAAiB,uCAAuC;AAC1D,aAAO,aAAa,KAAK,EAAE,OAAO,MAAM,SAAS,MAAM,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9F;AACA,WAAO,MAAM,gCAA2B,EAAE,KAAK,MAAM,CAAC;AACtD,WAAO,aAAa,KAAK,EAAE,OAAO,mCAAmC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzF;AACF;AAUA,eAAsB,OAAO,KAAkB;AAC7C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,MAAI,aAAsB,CAAC;AAC3B,MAAI;AACF,iBAAa,MAAM,IAAI,KAAK;AAAA,EAC9B,QAAQ;AAAA,EAER;AAEA,QAAM,aAAa,2BAA2B,UAAU,UAAU;AAClE,MAAI,CAAC,WAAW,SAAS;AACvB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,yBAAyB,MAAM,oBAAoB,QAAQ,WAAW,MAAM,OAAO;AAAA,MAC5F,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,cAAc,UAAU,QAAqB,aAAa;AAChE,UAAM,MAAM,MAAM,YAAY,QAAQ,KAAK,KAAK;AAAA,MAC9C,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,IACvB,CAAC;AACD,UAAM,YAAY,IAAI,gBAAgB,IAAI,SAAS,SAAS,8BAA8B;AAC1F,QAAI,CAAC,WAAW;AACd,aAAO,aAAa,KAAK,EAAE,OAAO,aAAa,MAAM,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrF;AAEA,UAAM,KAAK,UAAU,QAAuB,IAAI;AAChD,UAAM,OAAO,IAAI,iCAAiC,EAAE;AACpD,UAAM,UAAU,MAAM,KAAK,aAAa;AAAA,MACtC,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB,KAAK,SAAS;AAAA,MAC9B,SAAS,WAAW,KAAK,WAAW;AAAA,IACtC,CAAC;AACD,WAAO,aAAa,KAAK,EAAE,QAAQ,CAAC;AAAA,EACtC,SAAS,OAAO;AACd,WAAO,MAAM,mCAA8B,EAAE,KAAK,MAAM,CAAC;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AACF;",
+  "sourcesContent": ["import { existsSync, readFileSync } from 'node:fs'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { findApiKeyBySecret } from '@open-mercato/core/modules/api_keys/services/apiKeyService'\nimport { llmProviderRegistry } from '@open-mercato/shared/lib/ai/llm-provider-registry'\nimport { joinProviderModel } from '@open-mercato/shared/lib/ai/model-id'\nimport {\n  OPEN_CODE_PROVIDER_IDS,\n  OPEN_CODE_PROVIDERS,\n  getOpenCodeProviderConfiguredEnvKey,\n  isOpenCodeProviderConfigured,\n} from '@open-mercato/shared/lib/ai/opencode-provider'\nimport { AiAgentRuntimeOverrideRepository, AiAgentRuntimeOverrideValidationError } from '../../data/repositories/AiAgentRuntimeOverrideRepository'\nimport { AiTenantModelAllowlistRepository } from '../../data/repositories/AiTenantModelAllowlistRepository'\nimport { isBaseurlAllowlisted, readBaseurlAllowlist } from '../../lib/baseurl-allowlist'\nimport { loadAgentRegistry, listAgents } from '../../lib/agent-registry'\nimport { createModelFactory, resolveAllowRuntimeOverride } from '../../lib/model-factory'\nimport {\n  agentOverrideModelAllowlistEnvVarName,\n  agentOverrideProviderAllowlistEnvVarName,\n  canonicalProviderId,\n  hasAllowlistSnapshotRestrictions,\n  intersectEffectiveAllowlistWithSnapshot,\n  intersectAllowlists,\n  isProviderAllowed,\n  isProviderAllowedInEffective,\n  isProviderModelAllowed,\n  isProviderModelAllowedInEffective,\n  modelAllowlistEnvVarName,\n  readAgentRuntimeOverrideAllowlist,\n  readAllowedModels,\n  readAllowedProviders,\n  readAllowlistConfig,\n  type TenantAllowlistSnapshot,\n} from '../../lib/model-allowlist'\n\nconst logger = createLogger('ai_assistant')\n\nfunction modelCatalogWithAllowlistFallback(\n  models: ReadonlyArray<{ id: string; name: string; contextWindow?: number | null; tags?: readonly string[] }>,\n  allowlistModelIds: string[] | undefined,\n): ReadonlyArray<{ id: string; name: string; contextWindow?: number | null; tags?: readonly string[] }> {\n  if (models.length > 0) return models\n  return (allowlistModelIds ?? []).map((id) => ({ id, name: id }))\n}\n\nconst runtimeOverrideUpsertSchema = z.object({\n  providerId: z.string().min(1).max(64).nullable().optional(),\n  modelId: z.string().min(1).max(256).nullable().optional(),\n  baseURL: z.string().url().max(2048).nullable().optional(),\n  agentId: z.string().min(1).max(128).nullable().optional(),\n  allowedOverrideProviders: z.array(z.string().min(1).max(64)).nullable().optional(),\n  allowedOverrideModelsByProvider: z\n    .record(z.string().min(1).max(64), z.array(z.string().min(1).max(256)))\n    .optional(),\n})\n\nconst runtimeOverrideClearSchema = z.object({\n  agentId: z.string().min(1).max(128).nullable().optional(),\n})\n\nexport type RuntimeOverrideUpsertBody = z.infer<typeof runtimeOverrideUpsertSchema>\nexport type RuntimeOverrideClearBody = z.infer<typeof runtimeOverrideClearSchema>\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'AI Assistant',\n  summary: 'AI assistant settings',\n  methods: {\n    GET: { summary: 'Get AI provider configuration' },\n    PUT: {\n      summary: 'Upsert per-tenant AI runtime override',\n      description:\n        'Creates or updates the per-tenant AI runtime override (provider, model, baseURL). ' +\n        'Optionally scoped to a specific agent via `agentId`. ' +\n        'Gated by `ai_assistant.settings.manage`. ' +\n        'baseURL must match AI_RUNTIME_BASEURL_ALLOWLIST when set.',\n      requestBody: {\n        contentType: 'application/json',\n        description: 'Override payload. All fields nullable/optional; null explicitly clears the axis.',\n        schema: runtimeOverrideUpsertSchema,\n      },\n      responses: [\n        { status: 200, description: 'Override saved. Returns the saved row.' },\n      ],\n      errors: [\n        { status: 400, description: 'Validation error: unknown provider, invalid URL, or baseURL not allowlisted.' },\n        { status: 401, description: 'Unauthenticated.' },\n        { status: 403, description: 'Caller lacks ai_assistant.settings.manage.' },\n      ],\n    },\n    DELETE: {\n      summary: 'Clear per-tenant AI runtime override',\n      description:\n        'Soft-deletes the active per-tenant runtime override. ' +\n        'Pass `agentId` to clear only the agent-specific row; omit to clear the tenant-wide default. ' +\n        'Gated by `ai_assistant.settings.manage`. Idempotent \u2014 returns 200 with `cleared: false` when no active row existed.',\n      requestBody: {\n        contentType: 'application/json',\n        description: 'Optional agentId to scope the delete.',\n        schema: runtimeOverrideClearSchema,\n      },\n      responses: [\n        { status: 200, description: 'Returns `{ cleared: boolean }` indicating whether a row was found and removed.' },\n      ],\n      errors: [\n        { status: 401, description: 'Unauthenticated.' },\n        { status: 403, description: 'Caller lacks ai_assistant.settings.manage.' },\n      ],\n    },\n  },\n}\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['ai_assistant.view'] },\n  PUT: { requireAuth: true, requireFeatures: ['ai_assistant.settings.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['ai_assistant.settings.manage'] },\n}\n\n/**\n * GET /api/ai_assistant/settings\n *\n * Returns the current OpenCode provider configuration from environment variables\n * plus the Phase 4a additive fields: resolvedDefault, tenantOverride, agents[],\n * and availableProviders[].defaultModels.\n */\nexport async function GET(req: NextRequest) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  try {\n    const env = process.env as Record<string, string | undefined>\n    const configuredProviderHint = env.OM_AI_PROVIDER?.trim() || env.OPENCODE_PROVIDER?.trim() || null\n    const registryProviders = llmProviderRegistry.list()\n    const knownProviderIdsForAllowlist: string[] = [\n      ...OPEN_CODE_PROVIDER_IDS,\n      ...registryProviders\n        .map((p) => p.id)\n        .filter((id) => !(OPEN_CODE_PROVIDER_IDS as readonly string[]).includes(id)),\n    ]\n    const registryProviderId = configuredProviderHint\n      ? canonicalProviderId(configuredProviderHint, registryProviders.map((provider) => provider.id))\n      : null\n    const registryProvider = registryProviderId ? llmProviderRegistry.get(registryProviderId) : null\n    const fallbackOpenCodeProviderId = (\n      (configuredProviderHint\n        ? canonicalProviderId(configuredProviderHint, OPEN_CODE_PROVIDER_IDS as readonly string[])\n        : null) ?? 'openai'\n    ) as keyof typeof OPEN_CODE_PROVIDERS\n    const fallbackOpenCodeProvider = OPEN_CODE_PROVIDERS[fallbackOpenCodeProviderId]\n\n    const providerId = registryProvider?.id ?? fallbackOpenCodeProviderId\n    const providerName = registryProvider?.name ?? fallbackOpenCodeProvider?.name ?? providerId\n    const defaultProviderModel = registryProvider?.defaultModel ?? fallbackOpenCodeProvider?.defaultModel ?? ''\n    const configuredModelHint = env.OM_AI_MODEL?.trim() || env.OPENCODE_MODEL?.trim() || defaultProviderModel\n    const fallbackModelWithProvider = joinProviderModel(providerId, configuredModelHint)\n    const apiKeyConfigured = registryProvider\n      ? registryProvider.isConfigured(env)\n      : fallbackOpenCodeProvider\n        ? isOpenCodeProviderConfigured(fallbackOpenCodeProviderId)\n        : false\n    const displayEnvKey = registryProvider\n      ? registryProvider.getConfiguredEnvKey(env)\n      : fallbackOpenCodeProvider\n        ? getOpenCodeProviderConfiguredEnvKey(fallbackOpenCodeProviderId)\n        : null\n\n    // Check if the MCP API key is configured (required for MCP authentication):\n    // either directly via MCP_SERVER_API_KEY or via the shared key file that\n    // the containerized mcp service provisions (MCP_SERVER_API_KEY_FILE).\n    // The file variant is validated against the api_keys table \u2014 the file\n    // outlives DB resets and key deletion, so mere existence would report a\n    // green badge while OpenCode -> MCP auth is actually broken.\n    const mcpKeyFilePath = process.env.MCP_SERVER_API_KEY_FILE?.trim()\n    let mcpKeyConfigured = !!process.env.MCP_SERVER_API_KEY?.trim()\n    if (!mcpKeyConfigured && mcpKeyFilePath && existsSync(mcpKeyFilePath)) {\n      try {\n        const fileSecret = readFileSync(mcpKeyFilePath, 'utf8').trim()\n        if (fileSecret.startsWith('omk_')) {\n          const keyContainer = await createRequestContainer()\n          const keyEm = keyContainer.resolve<EntityManager>('em')\n          mcpKeyConfigured = !!(await findApiKeyBySecret(keyEm, fileSecret))\n        }\n      } catch {\n        mcpKeyConfigured = false\n      }\n    }\n\n    // Phase 4a: resolve tenant override row and per-agent resolution matrix\n    let tenantOverride: {\n      providerId: string | null\n      modelId: string | null\n      baseURL: string | null\n      agentId: string | null\n      updatedAt: string\n    } | null = null\n\n    let agentResolutions: Array<{\n      agentId: string\n      moduleId: string\n      allowRuntimeOverride: boolean\n      allowRuntimeModelOverride: boolean\n      codeDefaultProviderId: string | null\n      codeDefaultModelId: string | null\n      override: {\n        providerId: string | null\n        modelId: string | null\n        baseURL: string | null\n        updatedAt: string\n      } | null\n      runtimeOverrideAllowlist: {\n        env: TenantAllowlistSnapshot | null\n        tenant: TenantAllowlistSnapshot | null\n        effective: ReturnType<typeof intersectAllowlists>\n        envVarNames: {\n          providers: string\n          modelsByProvider: Record<string, string>\n        }\n      }\n      providerId: string\n      modelId: string\n      baseURL: string | null\n      source: string\n    }> = []\n\n    let resolvedDefault: {\n      providerId: string\n      modelId: string\n      baseURL: string | null\n      source: string\n    } | null = null\n\n    let tenantAllowlistSnapshot: TenantAllowlistSnapshot | null = null\n\n    try {\n      const container = await createRequestContainer()\n      const tenantId = auth.tenantId ?? null\n      const organizationId = auth.orgId ?? null\n\n      if (tenantId) {\n        const em = container.resolve<EntityManager>('em')\n        const repo = new AiAgentRuntimeOverrideRepository(em)\n        const overrideRow = await repo.getDefault({ tenantId, organizationId, agentId: null })\n        if (overrideRow) {\n          tenantOverride = {\n            providerId: overrideRow.providerId ?? null,\n            modelId: overrideRow.modelId ?? null,\n            baseURL: overrideRow.baseUrl ?? null,\n            agentId: overrideRow.agentId ?? null,\n            updatedAt: overrideRow.updatedAt.toISOString(),\n          }\n        }\n\n        const allowlistRepo = new AiTenantModelAllowlistRepository(em)\n        tenantAllowlistSnapshot = await allowlistRepo.getSnapshot({\n          tenantId,\n          organizationId,\n        })\n\n        const factory = createModelFactory(container)\n        const defaultResolution = factory.resolveModel({\n          tenantAllowlist: tenantAllowlistSnapshot,\n          tenantOverride: tenantOverride\n            ? { providerId: tenantOverride.providerId, modelId: tenantOverride.modelId, baseURL: tenantOverride.baseURL }\n            : undefined,\n        })\n        resolvedDefault = {\n          providerId: defaultResolution.providerId,\n          modelId: defaultResolution.modelId,\n          baseURL: defaultResolution.baseURL ?? null,\n          source: defaultResolution.source,\n        }\n\n        await loadAgentRegistry()\n        const agents = listAgents()\n        const agentResolutionPromises = agents.map(async (agent) => {\n          const agentOverrideRow = await repo.getExact({\n            tenantId,\n            organizationId,\n            agentId: agent.id,\n          })\n          const agentTenantOverride = agentOverrideRow\n            ? {\n                providerId: agentOverrideRow.providerId ?? null,\n                modelId: agentOverrideRow.modelId ?? null,\n                baseURL: agentOverrideRow.baseUrl ?? null,\n              }\n            : (tenantOverride ?? undefined)\n          const agentResolution = factory.resolveModel({\n            moduleId: agent.moduleId,\n            agentDefaultModel: agent.defaultModel,\n            agentDefaultProvider: agent.defaultProvider,\n            agentDefaultBaseUrl: agent.defaultBaseUrl,\n            allowRuntimeOverride: resolveAllowRuntimeOverride(agent),\n            tenantOverride: agentTenantOverride,\n            tenantAllowlist: tenantAllowlistSnapshot,\n          })\n          const agentEnvAllowlist = readAgentRuntimeOverrideAllowlist(\n            env,\n            agent.id,\n            knownProviderIdsForAllowlist,\n          )\n          const agentTenantAllowlist = agentOverrideRow\n            ? {\n                allowedProviders: agentOverrideRow.allowedOverrideProviders ?? null,\n                allowedModelsByProvider: agentOverrideRow.allowedOverrideModelsByProvider ?? {},\n              }\n            : null\n          const baseEffectiveAllowlist = intersectAllowlists(\n            env,\n            knownProviderIdsForAllowlist,\n            tenantAllowlistSnapshot,\n          )\n          const agentEffectiveAllowlist = intersectEffectiveAllowlistWithSnapshot(\n            intersectEffectiveAllowlistWithSnapshot(\n              baseEffectiveAllowlist,\n              knownProviderIdsForAllowlist,\n              agentEnvAllowlist,\n            ),\n            knownProviderIdsForAllowlist,\n            agentTenantAllowlist,\n          )\n          const agentModelEnvVars = Object.fromEntries(\n            knownProviderIdsForAllowlist.map((providerId) => [\n              providerId,\n              agentOverrideModelAllowlistEnvVarName(agent.id, providerId),\n            ]),\n          )\n          return {\n            agentId: agent.id,\n            moduleId: agent.moduleId,\n            allowRuntimeOverride: resolveAllowRuntimeOverride(agent),\n            allowRuntimeModelOverride: resolveAllowRuntimeOverride(agent),\n            codeDefaultProviderId: agent.defaultProvider ?? null,\n            codeDefaultModelId: agent.defaultModel ?? null,\n            override: agentOverrideRow\n              ? {\n                  providerId: agentOverrideRow.providerId ?? null,\n                  modelId: agentOverrideRow.modelId ?? null,\n                  baseURL: agentOverrideRow.baseUrl ?? null,\n                  updatedAt: agentOverrideRow.updatedAt.toISOString(),\n                }\n              : null,\n            runtimeOverrideAllowlist: {\n              env: agentEnvAllowlist,\n              tenant: hasAllowlistSnapshotRestrictions(agentTenantAllowlist)\n                ? agentTenantAllowlist\n                : null,\n              effective: agentEffectiveAllowlist,\n              envVarNames: {\n                providers: agentOverrideProviderAllowlistEnvVarName(agent.id),\n                modelsByProvider: agentModelEnvVars,\n              },\n            },\n            providerId: agentResolution.providerId,\n            modelId: agentResolution.modelId,\n            baseURL: agentResolution.baseURL ?? null,\n            source: agentResolution.source,\n          }\n        })\n        agentResolutions = await Promise.all(agentResolutionPromises)\n      }\n    } catch (overrideError) {\n      // Phase 4a fields are best-effort \u2014 log and continue returning the base response\n      logger.warn('AI Settings \u2014 Failed to compute Phase 4a override fields', { err: overrideError })\n    }\n\n    // Build availableProviders with Phase 4a defaultModels, then clip to the\n    // EFFECTIVE allowlist \u2014 env intersected with the per-tenant snapshot.\n    // The env allowlist is the OUTER constraint; the tenant allowlist (Phase\n    // 1780-6) narrows it further. The settings UI must never offer a value\n    // the runtime would refuse to honor.\n    const allowlistConfig = readAllowlistConfig(env, knownProviderIdsForAllowlist)\n    const effectiveAllowlist = intersectAllowlists(\n      env,\n      knownProviderIdsForAllowlist,\n      tenantAllowlistSnapshot,\n    )\n\n    const allRawProviders = [\n      ...OPEN_CODE_PROVIDER_IDS.map((id) => {\n        const info = OPEN_CODE_PROVIDERS[id]\n        const registryProvider = llmProviderRegistry.get(id)\n        return {\n          id,\n          name: info.name,\n          defaultModel: info.defaultModel,\n          envKey: getOpenCodeProviderConfiguredEnvKey(id),\n          configured: isOpenCodeProviderConfigured(id),\n          defaultModels: registryProvider?.defaultModels ?? [],\n        }\n      }),\n      // Also surface any llmProviderRegistry providers not in OPEN_CODE_PROVIDER_IDS\n      ...llmProviderRegistry.list()\n        .filter((p) => !(OPEN_CODE_PROVIDER_IDS as readonly string[]).includes(p.id))\n        .map((p) => ({\n          id: p.id,\n          name: p.name,\n          defaultModel: p.defaultModels[0]?.id ?? '',\n          envKey: null,\n          configured: p.isConfigured(),\n          defaultModels: p.defaultModels,\n        })),\n    ]\n\n    const availableProviders = allRawProviders\n      .filter((p) => isProviderAllowedInEffective(effectiveAllowlist, p.id))\n      .map((p) => {\n        const effectiveModelsList = effectiveAllowlist.modelsByProvider[p.id]\n        const catalogModels = modelCatalogWithAllowlistFallback(\n          p.defaultModels,\n          effectiveModelsList,\n        )\n        const clippedDefaults = effectiveModelsList !== undefined\n          ? catalogModels.filter((m) => effectiveModelsList.includes(m.id))\n          : catalogModels\n        return {\n          ...p,\n          defaultModel: effectiveModelsList && !effectiveModelsList.includes(p.defaultModel)\n            ? (effectiveModelsList[0] ?? p.defaultModel)\n            : p.defaultModel || clippedDefaults[0]?.id || '',\n          defaultModels: clippedDefaults,\n        }\n      })\n\n    const allowlistProviders = allRawProviders\n      .filter((p) => isProviderAllowed(env, p.id))\n      .map((p) => {\n        const envModelsList = allowlistConfig.modelsByProvider[p.id]\n        const catalogModels = modelCatalogWithAllowlistFallback(\n          p.defaultModels,\n          envModelsList,\n        )\n        const envClippedDefaults = envModelsList !== undefined\n          ? catalogModels.filter((m) => envModelsList.includes(m.id))\n          : catalogModels\n        return {\n          ...p,\n          defaultModel: envModelsList && !envModelsList.includes(p.defaultModel)\n            ? (envModelsList[0] ?? p.defaultModel)\n            : p.defaultModel || envClippedDefaults[0]?.id || '',\n          defaultModels: envClippedDefaults,\n        }\n      })\n\n    return NextResponse.json({\n      provider: {\n        id: providerId,\n        name: providerName,\n        model: resolvedDefault\n          ? joinProviderModel(resolvedDefault.providerId, resolvedDefault.modelId)\n          : fallbackModelWithProvider,\n        defaultModel: defaultProviderModel,\n        envKey: displayEnvKey,\n        configured: apiKeyConfigured,\n      },\n      availableProviders,\n      // Editable universe for the tenant allowlist page. This is clipped only\n      // by env so tenant-hidden models remain visible and can be re-enabled.\n      allowlistProviders,\n      // Snapshot of the env-driven allowlist so the UI can render hints like\n      // \"limited to: openai, anthropic\" without re-implementing the parser.\n      allowlist: allowlistConfig,\n      // Per-tenant allowlist snapshot (Phase 1780-6). `null` when no row has\n      // been persisted yet \u2014 the runtime then falls back to env-only\n      // enforcement. The UI uses this to drive the editable MultiSelect.\n      tenantAllowlist: tenantAllowlistSnapshot,\n      // Effective allowlist after intersecting env with tenant. The UI uses\n      // this to render the \"what the runtime will actually accept\" summary\n      // and to clip pickers without re-implementing the intersection.\n      effectiveAllowlist,\n      mcpKeyConfigured,\n      resolvedDefault,\n      tenantOverride,\n      agents: agentResolutions,\n    })\n  } catch (error) {\n    logger.error('AI Settings \u2014 GET error', { err: error })\n    return NextResponse.json({ error: 'Failed to fetch settings' }, { status: 500 })\n  }\n}\n\n/**\n * PUT /api/ai_assistant/settings\n *\n * Upserts the per-tenant AI runtime override (Phase 4a). Requires\n * `ai_assistant.settings.manage`. The body is Zod-validated; a `baseURL`\n * must match `AI_RUNTIME_BASEURL_ALLOWLIST` when that env var is set.\n */\nexport async function PUT(req: NextRequest) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  let parsedBody: unknown\n  try {\n    parsedBody = await req.json()\n  } catch {\n    return NextResponse.json({ error: 'Request body must be valid JSON.', code: 'validation_error' }, { status: 400 })\n  }\n\n  const bodyResult = runtimeOverrideUpsertSchema.safeParse(parsedBody)\n  if (!bodyResult.success) {\n    return NextResponse.json(\n      { error: 'Invalid request body.', code: 'validation_error', issues: bodyResult.error.issues },\n      { status: 400 },\n    )\n  }\n\n  const { providerId: requestedProviderId, modelId, baseURL, agentId } = bodyResult.data\n  const knownProviderIdsForRequest = llmProviderRegistry.list().map((p) => p.id)\n  const providerId = requestedProviderId\n    ? canonicalProviderId(requestedProviderId, knownProviderIdsForRequest) ?? requestedProviderId\n    : requestedProviderId\n\n  if (baseURL && baseURL.trim().length > 0) {\n    const allowlist = readBaseurlAllowlist()\n    if (!isBaseurlAllowlisted(baseURL.trim(), allowlist)) {\n      return NextResponse.json(\n        {\n          error: `baseURL \"${baseURL}\" is not in AI_RUNTIME_BASEURL_ALLOWLIST.`,\n          code: 'baseurl_not_allowlisted',\n        },\n        { status: 400 },\n      )\n    }\n  }\n\n  const allowedOverrideProviders = bodyResult.data.allowedOverrideProviders === undefined\n    ? undefined\n    : bodyResult.data.allowedOverrideProviders?.map((id) =>\n        canonicalProviderId(id, knownProviderIdsForRequest) ?? id,\n      ) ?? null\n  const allowedOverrideModelsByProvider = bodyResult.data.allowedOverrideModelsByProvider === undefined\n    ? undefined\n    : Object.fromEntries(\n        Object.entries(bodyResult.data.allowedOverrideModelsByProvider ?? {}).map(([id, models]) => [\n          canonicalProviderId(id, knownProviderIdsForRequest) ?? id,\n          models,\n        ]),\n      )\n  const hasRuntimeOverrideAllowlistWrite =\n    allowedOverrideProviders !== undefined || allowedOverrideModelsByProvider !== undefined\n\n  // Env-driven provider/model allowlist (Phase 1780-5) intersected with the\n  // per-tenant allowlist (Phase 1780-6): the EFFECTIVE allowlist clips which\n  // (provider, model) pairs the runtime accepts. Reject settings PUT requests\n  // for pairs outside that effective set so the settings UI never persists a\n  // value the runtime would later refuse. Tenant-allowlist enforcement is\n  // best-effort here: if the snapshot lookup fails we fall back to env-only\n  // checks (the runtime still re-clips at resolution time).\n  let putEffectiveAllowlist: ReturnType<typeof intersectAllowlists> | null = null\n  if (providerId || hasRuntimeOverrideAllowlistWrite) {\n    try {\n      const previewContainer = await createRequestContainer()\n      const knownIdsForCheck = [\n        ...OPEN_CODE_PROVIDER_IDS,\n        ...llmProviderRegistry\n          .list()\n          .map((p) => p.id)\n          .filter((id) => !(OPEN_CODE_PROVIDER_IDS as readonly string[]).includes(id)),\n      ]\n      let snapshot: TenantAllowlistSnapshot | null = null\n      if (auth.tenantId) {\n        try {\n          const em = previewContainer.resolve<EntityManager>('em')\n          const allowlistRepo = new AiTenantModelAllowlistRepository(em)\n          snapshot = await allowlistRepo.getSnapshot({\n            tenantId: auth.tenantId,\n            organizationId: auth.orgId ?? null,\n          })\n        } catch {\n          snapshot = null\n        }\n      }\n      putEffectiveAllowlist = intersectAllowlists(\n        process.env as Record<string, string | undefined>,\n        knownIdsForCheck,\n        snapshot,\n      )\n    } catch {\n      putEffectiveAllowlist = null\n    }\n\n    if (providerId && putEffectiveAllowlist) {\n      if (!isProviderAllowedInEffective(putEffectiveAllowlist, providerId)) {\n        const source = putEffectiveAllowlist.tenantOverridesActive\n          ? 'the effective allowlist (env \u2229 tenant)'\n          : 'OM_AI_AVAILABLE_PROVIDERS'\n        return NextResponse.json(\n          {\n            error: `Provider \"${providerId}\" is not in ${source}.`,\n            code: 'provider_not_allowlisted',\n          },\n          { status: 400 },\n        )\n      }\n      if (modelId && !isProviderModelAllowedInEffective(putEffectiveAllowlist, providerId, modelId)) {\n        const source = putEffectiveAllowlist.tenantOverridesActive\n          ? `the effective allowlist (env \u2229 tenant) for \"${providerId}\"`\n          : modelAllowlistEnvVarName(providerId)\n        return NextResponse.json(\n          {\n            error: `Model \"${modelId}\" is not in ${source}.`,\n            code: 'model_not_allowlisted',\n          },\n          { status: 400 },\n        )\n      }\n    } else if (providerId) {\n      if (!isProviderAllowed(process.env, providerId)) {\n        return NextResponse.json(\n          {\n            error: `Provider \"${requestedProviderId}\" is not in OM_AI_AVAILABLE_PROVIDERS.`,\n            code: 'provider_not_allowlisted',\n          },\n          { status: 400 },\n        )\n      }\n      if (modelId && !isProviderModelAllowed(process.env, providerId, modelId)) {\n        return NextResponse.json(\n          {\n            error: `Model \"${modelId}\" is not in ${modelAllowlistEnvVarName(providerId)}.`,\n            code: 'model_not_allowlisted',\n          },\n          { status: 400 },\n        )\n      }\n    }\n  }\n\n  if (hasRuntimeOverrideAllowlistWrite && !agentId) {\n    return NextResponse.json(\n      {\n        error: 'agentId is required when saving chat override allowlist settings.',\n        code: 'agent_required',\n      },\n      { status: 400 },\n    )\n  }\n\n  if (Array.isArray(allowedOverrideProviders)) {\n    for (const id of allowedOverrideProviders) {\n      if (putEffectiveAllowlist && !isProviderAllowedInEffective(putEffectiveAllowlist, id)) {\n        return NextResponse.json(\n          {\n            error: `Provider \"${id}\" is not in the effective tenant allowlist; per-agent chat override choices may not widen it.`,\n            code: 'provider_not_allowlisted',\n          },\n          { status: 400 },\n        )\n      }\n    }\n  }\n  if (allowedOverrideModelsByProvider) {\n    for (const [id, models] of Object.entries(allowedOverrideModelsByProvider)) {\n      if (putEffectiveAllowlist && !isProviderAllowedInEffective(putEffectiveAllowlist, id)) {\n        return NextResponse.json(\n          {\n            error: `Provider \"${id}\" is not in the effective tenant allowlist; cannot save per-agent model choices for it.`,\n            code: 'provider_not_allowlisted',\n          },\n          { status: 400 },\n        )\n      }\n      for (const allowedModelId of models) {\n        if (\n          putEffectiveAllowlist &&\n          !isProviderModelAllowedInEffective(putEffectiveAllowlist, id, allowedModelId)\n        ) {\n          return NextResponse.json(\n            {\n              error: `Model \"${allowedModelId}\" is not in the effective tenant allowlist for \"${id}\".`,\n              code: 'model_not_allowlisted',\n            },\n            { status: 400 },\n          )\n        }\n      }\n    }\n  }\n\n  try {\n    const container = await createRequestContainer()\n    const rbacService = container.resolve<RbacService>('rbacService')\n    const acl = await rbacService.loadAcl(auth.sub, {\n      tenantId: auth.tenantId,\n      organizationId: auth.orgId,\n    })\n    const canManage = acl.isSuperAdmin || acl.features.includes('ai_assistant.settings.manage')\n    if (!canManage) {\n      return NextResponse.json({ error: 'Forbidden', code: 'forbidden' }, { status: 403 })\n    }\n\n    const em = container.resolve<EntityManager>('em')\n    const repo = new AiAgentRuntimeOverrideRepository(em)\n    const upsertInput = {\n      agentId: agentId ?? null,\n      ...(Object.prototype.hasOwnProperty.call(bodyResult.data, 'providerId')\n        ? { providerId: providerId ?? null }\n        : {}),\n      ...(Object.prototype.hasOwnProperty.call(bodyResult.data, 'modelId')\n        ? { modelId: modelId ?? null }\n        : {}),\n      ...(Object.prototype.hasOwnProperty.call(bodyResult.data, 'baseURL')\n        ? { baseURL: baseURL ?? null }\n        : {}),\n      ...(allowedOverrideProviders !== undefined\n        ? { allowedOverrideProviders }\n        : {}),\n      ...(allowedOverrideModelsByProvider !== undefined\n        ? { allowedOverrideModelsByProvider }\n        : {}),\n    }\n    const row = await repo.upsertDefault(\n      upsertInput,\n      { tenantId: auth.tenantId ?? '', organizationId: auth.orgId ?? null, userId: auth.sub },\n    )\n    return NextResponse.json({\n      id: row.id,\n      tenantId: row.tenantId,\n      organizationId: row.organizationId,\n      agentId: row.agentId,\n      providerId: row.providerId,\n      modelId: row.modelId,\n      baseURL: row.baseUrl,\n      allowedOverrideProviders: row.allowedOverrideProviders ?? null,\n      allowedOverrideModelsByProvider: row.allowedOverrideModelsByProvider ?? {},\n      updatedAt: row.updatedAt,\n    })\n  } catch (error) {\n    if (error instanceof AiAgentRuntimeOverrideValidationError) {\n      return NextResponse.json({ error: error.message, code: 'provider_unknown' }, { status: 400 })\n    }\n    logger.error('AI Settings \u2014 PUT error', { err: error })\n    return NextResponse.json({ error: 'Failed to save runtime override.' }, { status: 500 })\n  }\n}\n\n/**\n * DELETE /api/ai_assistant/settings\n *\n * Soft-deletes the active per-tenant AI runtime override (Phase 4a). Requires\n * `ai_assistant.settings.manage`. Pass `agentId` in the body to clear only\n * the agent-specific row; omit (or null) to clear the tenant-wide default.\n * Idempotent \u2014 returns `{ cleared: false }` when no active row was found.\n */\nexport async function DELETE(req: NextRequest) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  let parsedBody: unknown = {}\n  try {\n    parsedBody = await req.json()\n  } catch {\n    // Body is optional for DELETE \u2014 empty body is fine\n  }\n\n  const bodyResult = runtimeOverrideClearSchema.safeParse(parsedBody)\n  if (!bodyResult.success) {\n    return NextResponse.json(\n      { error: 'Invalid request body.', code: 'validation_error', issues: bodyResult.error.issues },\n      { status: 400 },\n    )\n  }\n\n  try {\n    const container = await createRequestContainer()\n    const rbacService = container.resolve<RbacService>('rbacService')\n    const acl = await rbacService.loadAcl(auth.sub, {\n      tenantId: auth.tenantId,\n      organizationId: auth.orgId,\n    })\n    const canManage = acl.isSuperAdmin || acl.features.includes('ai_assistant.settings.manage')\n    if (!canManage) {\n      return NextResponse.json({ error: 'Forbidden', code: 'forbidden' }, { status: 403 })\n    }\n\n    const em = container.resolve<EntityManager>('em')\n    const repo = new AiAgentRuntimeOverrideRepository(em)\n    const cleared = await repo.clearDefault({\n      tenantId: auth.tenantId ?? '',\n      organizationId: auth.orgId ?? null,\n      agentId: bodyResult.data.agentId ?? null,\n    })\n    return NextResponse.json({ cleared })\n  } catch (error) {\n    logger.error('AI Settings \u2014 DELETE error', { err: error })\n    return NextResponse.json({ error: 'Failed to clear runtime override.' }, { status: 500 })\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,YAAY,oBAAoB;AACzC,SAAS,oBAAoB;AAC7B,SAAS,oBAAsC;AAC/C,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAGvC,SAAS,0BAA0B;AACnC,SAAS,2BAA2B;AACpC,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,kCAAkC,6CAA6C;AACxF,SAAS,wCAAwC;AACjD,SAAS,sBAAsB,4BAA4B;AAC3D,SAAS,mBAAmB,kBAAkB;AAC9C,SAAS,oBAAoB,mCAAmC;AAChE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAGA;AAAA,OAEK;AAEP,MAAM,SAAS,aAAa,cAAc;AAE1C,SAAS,kCACP,QACA,mBACsG;AACtG,MAAI,OAAO,SAAS,EAAG,QAAO;AAC9B,UAAQ,qBAAqB,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,MAAM,GAAG,EAAE;AACjE;AAEA,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EACxD,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACxD,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EACxD,0BAA0B,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACjF,iCAAiC,EAC9B,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,EACrE,SAAS;AACd,CAAC;AAED,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAC1D,CAAC;AAKM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK,EAAE,SAAS,gCAAgC;AAAA,IAChD,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MAIF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,yCAAyC;AAAA,MACvE;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,+EAA+E;AAAA,QAC3G,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,QAC/C,EAAE,QAAQ,KAAK,aAAa,6CAA6C;AAAA,MAC3E;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,MAGF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,iFAAiF;AAAA,MAC/G;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,QAC/C,EAAE,QAAQ,KAAK,aAAa,6CAA6C;AAAA,MAC3E;AAAA,IACF;AAAA,EACF;AACF;AAEO,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AAAA,EACjE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,8BAA8B,EAAE;AAAA,EAC5E,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,8BAA8B,EAAE;AACjF;AASA,eAAsB,IAAI,KAAkB;AAC1C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,MAAI;AACF,UAAM,MAAM,QAAQ;AACpB,UAAM,yBAAyB,IAAI,gBAAgB,KAAK,KAAK,IAAI,mBAAmB,KAAK,KAAK;AAC9F,UAAM,oBAAoB,oBAAoB,KAAK;AACnD,UAAM,+BAAyC;AAAA,MAC7C,GAAG;AAAA,MACH,GAAG,kBACA,IAAI,CAAC,MAAM,EAAE,EAAE,EACf,OAAO,CAAC,OAAO,CAAE,uBAA6C,SAAS,EAAE,CAAC;AAAA,IAC/E;AACA,UAAM,qBAAqB,yBACvB,oBAAoB,wBAAwB,kBAAkB,IAAI,CAAC,aAAa,SAAS,EAAE,CAAC,IAC5F;AACJ,UAAM,mBAAmB,qBAAqB,oBAAoB,IAAI,kBAAkB,IAAI;AAC5F,UAAM,8BACH,yBACG,oBAAoB,wBAAwB,sBAA2C,IACvF,SAAS;AAEf,UAAM,2BAA2B,oBAAoB,0BAA0B;AAE/E,UAAM,aAAa,kBAAkB,MAAM;AAC3C,UAAM,eAAe,kBAAkB,QAAQ,0BAA0B,QAAQ;AACjF,UAAM,uBAAuB,kBAAkB,gBAAgB,0BAA0B,gBAAgB;AACzG,UAAM,sBAAsB,IAAI,aAAa,KAAK,KAAK,IAAI,gBAAgB,KAAK,KAAK;AACrF,UAAM,4BAA4B,kBAAkB,YAAY,mBAAmB;AACnF,UAAM,mBAAmB,mBACrB,iBAAiB,aAAa,GAAG,IACjC,2BACE,6BAA6B,0BAA0B,IACvD;AACN,UAAM,gBAAgB,mBAClB,iBAAiB,oBAAoB,GAAG,IACxC,2BACE,oCAAoC,0BAA0B,IAC9D;AAQN,UAAM,iBAAiB,QAAQ,IAAI,yBAAyB,KAAK;AACjE,QAAI,mBAAmB,CAAC,CAAC,QAAQ,IAAI,oBAAoB,KAAK;AAC9D,QAAI,CAAC,oBAAoB,kBAAkB,WAAW,cAAc,GAAG;AACrE,UAAI;AACF,cAAM,aAAa,aAAa,gBAAgB,MAAM,EAAE,KAAK;AAC7D,YAAI,WAAW,WAAW,MAAM,GAAG;AACjC,gBAAM,eAAe,MAAM,uBAAuB;AAClD,gBAAM,QAAQ,aAAa,QAAuB,IAAI;AACtD,6BAAmB,CAAC,CAAE,MAAM,mBAAmB,OAAO,UAAU;AAAA,QAClE;AAAA,MACF,QAAQ;AACN,2BAAmB;AAAA,MACrB;AAAA,IACF;AAGA,QAAI,iBAMO;AAEX,QAAI,mBA0BC,CAAC;AAEN,QAAI,kBAKO;AAEX,QAAI,0BAA0D;AAE9D,QAAI;AACF,YAAM,YAAY,MAAM,uBAAuB;AAC/C,YAAM,WAAW,KAAK,YAAY;AAClC,YAAM,iBAAiB,KAAK,SAAS;AAErC,UAAI,UAAU;AACZ,cAAM,KAAK,UAAU,QAAuB,IAAI;AAChD,cAAM,OAAO,IAAI,iCAAiC,EAAE;AACpD,cAAM,cAAc,MAAM,KAAK,WAAW,EAAE,UAAU,gBAAgB,SAAS,KAAK,CAAC;AACrF,YAAI,aAAa;AACf,2BAAiB;AAAA,YACf,YAAY,YAAY,cAAc;AAAA,YACtC,SAAS,YAAY,WAAW;AAAA,YAChC,SAAS,YAAY,WAAW;AAAA,YAChC,SAAS,YAAY,WAAW;AAAA,YAChC,WAAW,YAAY,UAAU,YAAY;AAAA,UAC/C;AAAA,QACF;AAEA,cAAM,gBAAgB,IAAI,iCAAiC,EAAE;AAC7D,kCAA0B,MAAM,cAAc,YAAY;AAAA,UACxD;AAAA,UACA;AAAA,QACF,CAAC;AAED,cAAM,UAAU,mBAAmB,SAAS;AAC5C,cAAM,oBAAoB,QAAQ,aAAa;AAAA,UAC7C,iBAAiB;AAAA,UACjB,gBAAgB,iBACZ,EAAE,YAAY,eAAe,YAAY,SAAS,eAAe,SAAS,SAAS,eAAe,QAAQ,IAC1G;AAAA,QACN,CAAC;AACD,0BAAkB;AAAA,UAChB,YAAY,kBAAkB;AAAA,UAC9B,SAAS,kBAAkB;AAAA,UAC3B,SAAS,kBAAkB,WAAW;AAAA,UACtC,QAAQ,kBAAkB;AAAA,QAC5B;AAEA,cAAM,kBAAkB;AACxB,cAAM,SAAS,WAAW;AAC1B,cAAM,0BAA0B,OAAO,IAAI,OAAO,UAAU;AAC1D,gBAAM,mBAAmB,MAAM,KAAK,SAAS;AAAA,YAC3C;AAAA,YACA;AAAA,YACA,SAAS,MAAM;AAAA,UACjB,CAAC;AACD,gBAAM,sBAAsB,mBACxB;AAAA,YACE,YAAY,iBAAiB,cAAc;AAAA,YAC3C,SAAS,iBAAiB,WAAW;AAAA,YACrC,SAAS,iBAAiB,WAAW;AAAA,UACvC,IACC,kBAAkB;AACvB,gBAAM,kBAAkB,QAAQ,aAAa;AAAA,YAC3C,UAAU,MAAM;AAAA,YAChB,mBAAmB,MAAM;AAAA,YACzB,sBAAsB,MAAM;AAAA,YAC5B,qBAAqB,MAAM;AAAA,YAC3B,sBAAsB,4BAA4B,KAAK;AAAA,YACvD,gBAAgB;AAAA,YAChB,iBAAiB;AAAA,UACnB,CAAC;AACD,gBAAM,oBAAoB;AAAA,YACxB;AAAA,YACA,MAAM;AAAA,YACN;AAAA,UACF;AACA,gBAAM,uBAAuB,mBACzB;AAAA,YACE,kBAAkB,iBAAiB,4BAA4B;AAAA,YAC/D,yBAAyB,iBAAiB,mCAAmC,CAAC;AAAA,UAChF,IACA;AACJ,gBAAM,yBAAyB;AAAA,YAC7B;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACA,gBAAM,0BAA0B;AAAA,YAC9B;AAAA,cACE;AAAA,cACA;AAAA,cACA;AAAA,YACF;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACA,gBAAM,oBAAoB,OAAO;AAAA,YAC/B,6BAA6B,IAAI,CAACA,gBAAe;AAAA,cAC/CA;AAAA,cACA,sCAAsC,MAAM,IAAIA,WAAU;AAAA,YAC5D,CAAC;AAAA,UACH;AACA,iBAAO;AAAA,YACL,SAAS,MAAM;AAAA,YACf,UAAU,MAAM;AAAA,YAChB,sBAAsB,4BAA4B,KAAK;AAAA,YACvD,2BAA2B,4BAA4B,KAAK;AAAA,YAC5D,uBAAuB,MAAM,mBAAmB;AAAA,YAChD,oBAAoB,MAAM,gBAAgB;AAAA,YAC1C,UAAU,mBACN;AAAA,cACE,YAAY,iBAAiB,cAAc;AAAA,cAC3C,SAAS,iBAAiB,WAAW;AAAA,cACrC,SAAS,iBAAiB,WAAW;AAAA,cACrC,WAAW,iBAAiB,UAAU,YAAY;AAAA,YACpD,IACA;AAAA,YACJ,0BAA0B;AAAA,cACxB,KAAK;AAAA,cACL,QAAQ,iCAAiC,oBAAoB,IACzD,uBACA;AAAA,cACJ,WAAW;AAAA,cACX,aAAa;AAAA,gBACX,WAAW,yCAAyC,MAAM,EAAE;AAAA,gBAC5D,kBAAkB;AAAA,cACpB;AAAA,YACF;AAAA,YACA,YAAY,gBAAgB;AAAA,YAC5B,SAAS,gBAAgB;AAAA,YACzB,SAAS,gBAAgB,WAAW;AAAA,YACpC,QAAQ,gBAAgB;AAAA,UAC1B;AAAA,QACF,CAAC;AACD,2BAAmB,MAAM,QAAQ,IAAI,uBAAuB;AAAA,MAC9D;AAAA,IACF,SAAS,eAAe;AAEtB,aAAO,KAAK,iEAA4D,EAAE,KAAK,cAAc,CAAC;AAAA,IAChG;AAOA,UAAM,kBAAkB,oBAAoB,KAAK,4BAA4B;AAC7E,UAAM,qBAAqB;AAAA,MACzB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,UAAM,kBAAkB;AAAA,MACtB,GAAG,uBAAuB,IAAI,CAAC,OAAO;AACpC,cAAM,OAAO,oBAAoB,EAAE;AACnC,cAAMC,oBAAmB,oBAAoB,IAAI,EAAE;AACnD,eAAO;AAAA,UACL;AAAA,UACA,MAAM,KAAK;AAAA,UACX,cAAc,KAAK;AAAA,UACnB,QAAQ,oCAAoC,EAAE;AAAA,UAC9C,YAAY,6BAA6B,EAAE;AAAA,UAC3C,eAAeA,mBAAkB,iBAAiB,CAAC;AAAA,QACrD;AAAA,MACF,CAAC;AAAA;AAAA,MAED,GAAG,oBAAoB,KAAK,EACzB,OAAO,CAAC,MAAM,CAAE,uBAA6C,SAAS,EAAE,EAAE,CAAC,EAC3E,IAAI,CAAC,OAAO;AAAA,QACX,IAAI,EAAE;AAAA,QACN,MAAM,EAAE;AAAA,QACR,cAAc,EAAE,cAAc,CAAC,GAAG,MAAM;AAAA,QACxC,QAAQ;AAAA,QACR,YAAY,EAAE,aAAa;AAAA,QAC3B,eAAe,EAAE;AAAA,MACnB,EAAE;AAAA,IACN;AAEA,UAAM,qBAAqB,gBACxB,OAAO,CAAC,MAAM,6BAA6B,oBAAoB,EAAE,EAAE,CAAC,EACpE,IAAI,CAAC,MAAM;AACV,YAAM,sBAAsB,mBAAmB,iBAAiB,EAAE,EAAE;AACpE,YAAM,gBAAgB;AAAA,QACpB,EAAE;AAAA,QACF;AAAA,MACF;AACA,YAAM,kBAAkB,wBAAwB,SAC5C,cAAc,OAAO,CAAC,MAAM,oBAAoB,SAAS,EAAE,EAAE,CAAC,IAC9D;AACJ,aAAO;AAAA,QACL,GAAG;AAAA,QACH,cAAc,uBAAuB,CAAC,oBAAoB,SAAS,EAAE,YAAY,IAC5E,oBAAoB,CAAC,KAAK,EAAE,eAC7B,EAAE,gBAAgB,gBAAgB,CAAC,GAAG,MAAM;AAAA,QAChD,eAAe;AAAA,MACjB;AAAA,IACF,CAAC;AAEH,UAAM,qBAAqB,gBACxB,OAAO,CAAC,MAAM,kBAAkB,KAAK,EAAE,EAAE,CAAC,EAC1C,IAAI,CAAC,MAAM;AACV,YAAM,gBAAgB,gBAAgB,iBAAiB,EAAE,EAAE;AAC3D,YAAM,gBAAgB;AAAA,QACpB,EAAE;AAAA,QACF;AAAA,MACF;AACA,YAAM,qBAAqB,kBAAkB,SACzC,cAAc,OAAO,CAAC,MAAM,cAAc,SAAS,EAAE,EAAE,CAAC,IACxD;AACJ,aAAO;AAAA,QACL,GAAG;AAAA,QACH,cAAc,iBAAiB,CAAC,cAAc,SAAS,EAAE,YAAY,IAChE,cAAc,CAAC,KAAK,EAAE,eACvB,EAAE,gBAAgB,mBAAmB,CAAC,GAAG,MAAM;AAAA,QACnD,eAAe;AAAA,MACjB;AAAA,IACF,CAAC;AAEH,WAAO,aAAa,KAAK;AAAA,MACvB,UAAU;AAAA,QACR,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,OAAO,kBACH,kBAAkB,gBAAgB,YAAY,gBAAgB,OAAO,IACrE;AAAA,QACJ,cAAc;AAAA,QACd,QAAQ;AAAA,QACR,YAAY;AAAA,MACd;AAAA,MACA;AAAA;AAAA;AAAA,MAGA;AAAA;AAAA;AAAA,MAGA,WAAW;AAAA;AAAA;AAAA;AAAA,MAIX,iBAAiB;AAAA;AAAA;AAAA;AAAA,MAIjB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,IACV,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,gCAA2B,EAAE,KAAK,MAAM,CAAC;AACtD,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AACF;AASA,eAAsB,IAAI,KAAkB;AAC1C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,MAAI;AACJ,MAAI;AACF,iBAAa,MAAM,IAAI,KAAK;AAAA,EAC9B,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,MAAM,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnH;AAEA,QAAM,aAAa,4BAA4B,UAAU,UAAU;AACnE,MAAI,CAAC,WAAW,SAAS;AACvB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,yBAAyB,MAAM,oBAAoB,QAAQ,WAAW,MAAM,OAAO;AAAA,MAC5F,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,EAAE,YAAY,qBAAqB,SAAS,SAAS,QAAQ,IAAI,WAAW;AAClF,QAAM,6BAA6B,oBAAoB,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;AAC7E,QAAM,aAAa,sBACf,oBAAoB,qBAAqB,0BAA0B,KAAK,sBACxE;AAEJ,MAAI,WAAW,QAAQ,KAAK,EAAE,SAAS,GAAG;AACxC,UAAM,YAAY,qBAAqB;AACvC,QAAI,CAAC,qBAAqB,QAAQ,KAAK,GAAG,SAAS,GAAG;AACpD,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO,YAAY,OAAO;AAAA,UAC1B,MAAM;AAAA,QACR;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,2BAA2B,WAAW,KAAK,6BAA6B,SAC1E,SACA,WAAW,KAAK,0BAA0B;AAAA,IAAI,CAAC,OAC7C,oBAAoB,IAAI,0BAA0B,KAAK;AAAA,EACzD,KAAK;AACT,QAAM,kCAAkC,WAAW,KAAK,oCAAoC,SACxF,SACA,OAAO;AAAA,IACL,OAAO,QAAQ,WAAW,KAAK,mCAAmC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,MAAM,MAAM;AAAA,MAC1F,oBAAoB,IAAI,0BAA0B,KAAK;AAAA,MACvD;AAAA,IACF,CAAC;AAAA,EACH;AACJ,QAAM,mCACJ,6BAA6B,UAAa,oCAAoC;AAShF,MAAI,wBAAuE;AAC3E,MAAI,cAAc,kCAAkC;AAClD,QAAI;AACF,YAAM,mBAAmB,MAAM,uBAAuB;AACtD,YAAM,mBAAmB;AAAA,QACvB,GAAG;AAAA,QACH,GAAG,oBACA,KAAK,EACL,IAAI,CAAC,MAAM,EAAE,EAAE,EACf,OAAO,CAAC,OAAO,CAAE,uBAA6C,SAAS,EAAE,CAAC;AAAA,MAC/E;AACA,UAAI,WAA2C;AAC/C,UAAI,KAAK,UAAU;AACjB,YAAI;AACF,gBAAM,KAAK,iBAAiB,QAAuB,IAAI;AACvD,gBAAM,gBAAgB,IAAI,iCAAiC,EAAE;AAC7D,qBAAW,MAAM,cAAc,YAAY;AAAA,YACzC,UAAU,KAAK;AAAA,YACf,gBAAgB,KAAK,SAAS;AAAA,UAChC,CAAC;AAAA,QACH,QAAQ;AACN,qBAAW;AAAA,QACb;AAAA,MACF;AACA,8BAAwB;AAAA,QACtB,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF,QAAQ;AACN,8BAAwB;AAAA,IAC1B;AAEA,QAAI,cAAc,uBAAuB;AACvC,UAAI,CAAC,6BAA6B,uBAAuB,UAAU,GAAG;AACpE,cAAM,SAAS,sBAAsB,wBACjC,gDACA;AACJ,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,OAAO,aAAa,UAAU,eAAe,MAAM;AAAA,YACnD,MAAM;AAAA,UACR;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI,WAAW,CAAC,kCAAkC,uBAAuB,YAAY,OAAO,GAAG;AAC7F,cAAM,SAAS,sBAAsB,wBACjC,oDAA+C,UAAU,MACzD,yBAAyB,UAAU;AACvC,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,OAAO,UAAU,OAAO,eAAe,MAAM;AAAA,YAC7C,MAAM;AAAA,UACR;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF,WAAW,YAAY;AACrB,UAAI,CAAC,kBAAkB,QAAQ,KAAK,UAAU,GAAG;AAC/C,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,OAAO,aAAa,mBAAmB;AAAA,YACvC,MAAM;AAAA,UACR;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,UAAI,WAAW,CAAC,uBAAuB,QAAQ,KAAK,YAAY,OAAO,GAAG;AACxE,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,OAAO,UAAU,OAAO,eAAe,yBAAyB,UAAU,CAAC;AAAA,YAC3E,MAAM;AAAA,UACR;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,MAAI,oCAAoC,CAAC,SAAS;AAChD,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO;AAAA,QACP,MAAM;AAAA,MACR;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,MAAI,MAAM,QAAQ,wBAAwB,GAAG;AAC3C,eAAW,MAAM,0BAA0B;AACzC,UAAI,yBAAyB,CAAC,6BAA6B,uBAAuB,EAAE,GAAG;AACrF,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,OAAO,aAAa,EAAE;AAAA,YACtB,MAAM;AAAA,UACR;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,iCAAiC;AACnC,eAAW,CAAC,IAAI,MAAM,KAAK,OAAO,QAAQ,+BAA+B,GAAG;AAC1E,UAAI,yBAAyB,CAAC,6BAA6B,uBAAuB,EAAE,GAAG;AACrF,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,OAAO,aAAa,EAAE;AAAA,YACtB,MAAM;AAAA,UACR;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,iBAAW,kBAAkB,QAAQ;AACnC,YACE,yBACA,CAAC,kCAAkC,uBAAuB,IAAI,cAAc,GAC5E;AACA,iBAAO,aAAa;AAAA,YAClB;AAAA,cACE,OAAO,UAAU,cAAc,mDAAmD,EAAE;AAAA,cACpF,MAAM;AAAA,YACR;AAAA,YACA,EAAE,QAAQ,IAAI;AAAA,UAChB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,cAAc,UAAU,QAAqB,aAAa;AAChE,UAAM,MAAM,MAAM,YAAY,QAAQ,KAAK,KAAK;AAAA,MAC9C,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,IACvB,CAAC;AACD,UAAM,YAAY,IAAI,gBAAgB,IAAI,SAAS,SAAS,8BAA8B;AAC1F,QAAI,CAAC,WAAW;AACd,aAAO,aAAa,KAAK,EAAE,OAAO,aAAa,MAAM,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrF;AAEA,UAAM,KAAK,UAAU,QAAuB,IAAI;AAChD,UAAM,OAAO,IAAI,iCAAiC,EAAE;AACpD,UAAM,cAAc;AAAA,MAClB,SAAS,WAAW;AAAA,MACpB,GAAI,OAAO,UAAU,eAAe,KAAK,WAAW,MAAM,YAAY,IAClE,EAAE,YAAY,cAAc,KAAK,IACjC,CAAC;AAAA,MACL,GAAI,OAAO,UAAU,eAAe,KAAK,WAAW,MAAM,SAAS,IAC/D,EAAE,SAAS,WAAW,KAAK,IAC3B,CAAC;AAAA,MACL,GAAI,OAAO,UAAU,eAAe,KAAK,WAAW,MAAM,SAAS,IAC/D,EAAE,SAAS,WAAW,KAAK,IAC3B,CAAC;AAAA,MACL,GAAI,6BAA6B,SAC7B,EAAE,yBAAyB,IAC3B,CAAC;AAAA,MACL,GAAI,oCAAoC,SACpC,EAAE,gCAAgC,IAClC,CAAC;AAAA,IACP;AACA,UAAM,MAAM,MAAM,KAAK;AAAA,MACrB;AAAA,MACA,EAAE,UAAU,KAAK,YAAY,IAAI,gBAAgB,KAAK,SAAS,MAAM,QAAQ,KAAK,IAAI;AAAA,IACxF;AACA,WAAO,aAAa,KAAK;AAAA,MACvB,IAAI,IAAI;AAAA,MACR,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,MACpB,SAAS,IAAI;AAAA,MACb,YAAY,IAAI;AAAA,MAChB,SAAS,IAAI;AAAA,MACb,SAAS,IAAI;AAAA,MACb,0BAA0B,IAAI,4BAA4B;AAAA,MAC1D,iCAAiC,IAAI,mCAAmC,CAAC;AAAA,MACzE,WAAW,IAAI;AAAA,IACjB,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,iBAAiB,uCAAuC;AAC1D,aAAO,aAAa,KAAK,EAAE,OAAO,MAAM,SAAS,MAAM,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9F;AACA,WAAO,MAAM,gCAA2B,EAAE,KAAK,MAAM,CAAC;AACtD,WAAO,aAAa,KAAK,EAAE,OAAO,mCAAmC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzF;AACF;AAUA,eAAsB,OAAO,KAAkB;AAC7C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,MAAI,aAAsB,CAAC;AAC3B,MAAI;AACF,iBAAa,MAAM,IAAI,KAAK;AAAA,EAC9B,QAAQ;AAAA,EAER;AAEA,QAAM,aAAa,2BAA2B,UAAU,UAAU;AAClE,MAAI,CAAC,WAAW,SAAS;AACvB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,yBAAyB,MAAM,oBAAoB,QAAQ,WAAW,MAAM,OAAO;AAAA,MAC5F,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,cAAc,UAAU,QAAqB,aAAa;AAChE,UAAM,MAAM,MAAM,YAAY,QAAQ,KAAK,KAAK;AAAA,MAC9C,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,IACvB,CAAC;AACD,UAAM,YAAY,IAAI,gBAAgB,IAAI,SAAS,SAAS,8BAA8B;AAC1F,QAAI,CAAC,WAAW;AACd,aAAO,aAAa,KAAK,EAAE,OAAO,aAAa,MAAM,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrF;AAEA,UAAM,KAAK,UAAU,QAAuB,IAAI;AAChD,UAAM,OAAO,IAAI,iCAAiC,EAAE;AACpD,UAAM,UAAU,MAAM,KAAK,aAAa;AAAA,MACtC,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB,KAAK,SAAS;AAAA,MAC9B,SAAS,WAAW,KAAK,WAAW;AAAA,IACtC,CAAC;AACD,WAAO,aAAa,KAAK,EAAE,QAAQ,CAAC;AAAA,EACtC,SAAS,OAAO;AACd,WAAO,MAAM,mCAA8B,EAAE,KAAK,MAAM,CAAC;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AACF;",
   "names": ["providerId", "registryProvider"]
 }

package/dist/modules/ai_assistant/cli.js

@@ -129,6 +129,40 @@ const mcpDev = {
     await runMcpDevServer();
   }
 };
+const mcpEnsureApiKey = {
+  command: "mcp:ensure-api-key",
+  async run(rest) {
+    const args = parseArgs(rest);
+    const fileArg = typeof args.file === "string" ? args.file.trim() : "";
+    const filePath = fileArg || process.env.MCP_SERVER_API_KEY_FILE?.trim() || process.env.MCP_API_KEY_FILE?.trim() || "";
+    if (!filePath) {
+      console.error("Usage: mercato ai_assistant mcp:ensure-api-key --file <path> [options]");
+      console.error("");
+      console.error("Ensures a valid MCP server API key exists in the database and that its");
+      console.error("plaintext secret is stored in <path> (the idempotency anchor). The secret");
+      console.error("is never printed; consumers such as the OpenCode container read the file.");
+      console.error("");
+      console.error("Options:");
+      console.error("  --file <path>    Secret file path (or MCP_SERVER_API_KEY_FILE env)");
+      console.error("  --name <name>    API key name (default __mcp_server__)");
+      console.error("  --email <email>  Owner user email (default OM_INIT_SUPERADMIN_EMAIL, then superadmin@acme.com)");
+      console.error("  --rotate         Force rotation even when the file secret is still valid");
+      process.exitCode = 1;
+      return;
+    }
+    const keyName = typeof args.name === "string" && args.name.length > 0 ? args.name : void 0;
+    const ownerEmail = typeof args.email === "string" && args.email.length > 0 ? args.email : void 0;
+    const rotate = args.rotate === true || args.rotate === "true";
+    await ensureBootstrap();
+    const container = await createRequestContainer();
+    const em = container.resolve("em");
+    const rbac = container.resolve("rbacService");
+    const { ensureMcpApiKey } = await import("./lib/mcp-ensure-api-key.js");
+    const result = await ensureMcpApiKey({ em, filePath, keyName, ownerEmail, rotate, rbac });
+    const message = result.status === "valid" ? "Existing key is valid" : "New key created";
+    console.log(`[mcp:ensure-api-key] ${message} (id=${result.keyId}, prefix=${result.keyPrefix})`);
+  }
+};
 const listTools = {
   command: "mcp:list-tools",
   async run(rest) {
@@ -295,6 +329,7 @@ var cli_default = [
   mcpServe,
   mcpServeHttp,
   mcpDev,
+  mcpEnsureApiKey,
   listTools,
   entityGraph,
   runPendingActionCleanup,

package/dist/modules/ai_assistant/cli.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/ai_assistant/cli.ts"],
-  "sourcesContent": ["import type { ModuleCli } from '@open-mercato/shared/modules/registry'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { resetServerLoggerCache } from '@open-mercato/shared/lib/logger'\n/**\n * Ensure app bootstrap is called before creating DI container.\n * Uses the shared generated-bootstrap loader so the command works both from\n * the monorepo app and from standalone apps installed through npm packages.\n */\nasync function ensureBootstrap(): Promise<void> {\n  // First check if DI is already available\n  try {\n    const { getDiRegistrars } = await import('@open-mercato/shared/lib/di/container')\n    getDiRegistrars()\n    return // DI already available\n  } catch {\n    // DI not available, need to bootstrap\n  }\n\n  try {\n    const { bootstrapFromAppRoot } = await import('@open-mercato/shared/lib/bootstrap/dynamicLoader')\n    await bootstrapFromAppRoot()\n  } catch (error) {\n    console.error('[MCP] Bootstrap failed:', error instanceof Error ? error.message : error)\n    // Continue - some contexts may not have bootstrap available\n  }\n}\n\nfunction parseArgs(rest: string[]): Record<string, string | boolean> {\n  const args: Record<string, string | boolean> = {}\n  for (let i = 0; i < rest.length; i++) {\n    const arg = rest[i]\n    if (!arg?.startsWith('--')) continue\n\n    const [key, value] = arg.replace(/^--/, '').split('=')\n    if (value !== undefined) {\n      args[key] = value\n    } else if (rest[i + 1] && !rest[i + 1]!.startsWith('--')) {\n      args[key] = rest[i + 1]!\n      i++\n    } else {\n      args[key] = true\n    }\n  }\n  return args\n}\n\nconst mcpServe: ModuleCli = {\n  command: 'mcp:serve',\n  async run(rest) {\n    // stdout carries the MCP JSON-RPC protocol (StdioServerTransport) \u2014 route all\n    // facade logs to stderr and rebuild any pino root created earlier in this process.\n    process.env.OM_LOG_DESTINATION = 'stderr'\n    resetServerLoggerCache()\n    const args = parseArgs(rest)\n    // Prefer the OPEN_MERCATO_API_KEY env var so the secret never has to be\n    // placed on the command line (argv is world-readable via ps / /proc).\n    // The --api-key flag stays supported for backward compatibility.\n    const apiKey = String(args['api-key'] ?? args.apiKey ?? '') || process.env.OPEN_MERCATO_API_KEY || null\n    const tenantId = String(args.tenant ?? args.tenantId ?? '') || null\n    const organizationId = String(args.org ?? args.organizationId ?? '') || null\n    const userId = String(args.user ?? args.userId ?? '') || null\n    const debug = args.debug === true || args.debug === 'true'\n    const allowUnauthenticatedSuperadmin =\n      args['allow-unauthenticated-superadmin'] === true ||\n      args['allow-unauthenticated-superadmin'] === 'true'\n\n    // Either API key or tenant is required\n    if (!apiKey && !tenantId) {\n      console.error('Usage: mercato ai_assistant mcp:serve [options]')\n      console.error('')\n      console.error('Authentication (choose one):')\n      console.error('  OPEN_MERCATO_API_KEY env   API key secret (recommended \u2014 keeps the secret off argv)')\n      console.error('  --api-key <secret>         API key secret for authentication (visible in process listings)')\n      console.error('  --tenant <id>              Tenant ID (for manual context)')\n      console.error('')\n      console.error('Options (with --tenant):')\n      console.error('  --org <id>           Organization ID (optional)')\n      console.error('  --user <id>          User ID for ACL (required unless --allow-unauthenticated-superadmin is set)')\n      console.error('')\n      console.error('Common options:')\n      console.error('  --debug              Enable debug logging')\n      console.error('  --allow-unauthenticated-superadmin')\n      console.error('                       DEV/TEST ONLY: run as superadmin with no per-user ACL when')\n      console.error('                       no --user (and no --api-key) is supplied. Never use in production.')\n      console.error('')\n      console.error('Examples:')\n      console.error('  OPEN_MERCATO_API_KEY=omk_xxxx.yyyy... mercato ai_assistant mcp:serve')\n      console.error('  mercato ai_assistant mcp:serve --api-key omk_xxxx.yyyy...')\n      console.error('  mercato ai_assistant mcp:serve --tenant 123e4567-e89b-12d3-a456-426614174000 --user <user-id>')\n      console.error('  mercato ai_assistant mcp:serve --tenant 123e4567-e89b-12d3-a456-426614174000 --allow-unauthenticated-superadmin')\n      return\n    }\n\n    await ensureBootstrap()\n    const container = await createRequestContainer()\n\n    const { runMcpServer } = await import('./lib/mcp-server')\n\n    if (apiKey) {\n      await runMcpServer({\n        config: {\n          name: 'open-mercato-mcp',\n          version: '0.1.0',\n          debug,\n        },\n        container,\n        apiKeySecret: apiKey,\n      })\n    } else {\n      await runMcpServer({\n        config: {\n          name: 'open-mercato-mcp',\n          version: '0.1.0',\n          debug,\n        },\n        container,\n        context: {\n          tenantId,\n          organizationId,\n          userId,\n        },\n        allowUnauthenticatedSuperadmin,\n      })\n    }\n  },\n}\n\nconst MCP_DEFAULT_PORT = 3001\n\nconst mcpServeHttp: ModuleCli = {\n  command: 'mcp:serve-http',\n  async run(rest) {\n    const args = parseArgs(rest)\n    const portArg = parseInt(String(args.port ?? ''), 10)\n    const port = !portArg || isNaN(portArg) ? MCP_DEFAULT_PORT : portArg\n    const debug = args.debug === true || args.debug === 'true'\n\n    await ensureBootstrap()\n    const container = await createRequestContainer()\n\n    const { runMcpHttpServer } = await import('./lib/http-server')\n\n    await runMcpHttpServer({\n      config: {\n        name: 'open-mercato-mcp',\n        version: '0.1.0',\n        debug,\n      },\n      container,\n      port,\n    })\n  },\n}\n\nconst mcpDev: ModuleCli = {\n  command: 'mcp:dev',\n  async run() {\n    await ensureBootstrap()\n    const { runMcpDevServer } = await import('./lib/mcp-dev-server')\n    await runMcpDevServer()\n  },\n}\n\nconst listTools: ModuleCli = {\n  command: 'mcp:list-tools',\n  async run(rest) {\n    const args = parseArgs(rest)\n    const verbose = args.verbose === true || args.verbose === 'true'\n\n    // Ensure bootstrap runs so modules are registered for API discovery\n    await ensureBootstrap()\n\n    const { loadAllModuleTools } = await import('./lib/tool-loader')\n    await loadAllModuleTools()\n\n    const { getToolRegistry } = await import('./lib/tool-registry')\n    const registry = getToolRegistry()\n    const toolNames = registry.listToolNames()\n\n    if (toolNames.length === 0) {\n      console.log('\\nNo MCP tools registered.')\n      console.log('Tools can be registered by modules using registerMcpTool().\\n')\n      return\n    }\n\n    console.log(`\\nRegistered MCP Tools (${toolNames.length}):\\n`)\n\n    // Group tools by module\n    const byModule = new Map<string, string[]>()\n    for (const name of toolNames) {\n      const [module] = name.split('.')\n      const list = byModule.get(module) ?? []\n      list.push(name)\n      byModule.set(module, list)\n    }\n\n    // Sort modules alphabetically\n    const sortedModules = Array.from(byModule.keys()).sort((a, b) => (a < b ? -1 : a > b ? 1 : 0))\n\n    for (const module of sortedModules) {\n      const tools = byModule.get(module)!\n      console.log(`${module} (${tools.length} tools):`)\n\n      for (const name of tools.sort((a, b) => (a < b ? -1 : a > b ? 1 : 0))) {\n        const tool = registry.getTool(name)\n        if (!tool) continue\n\n        if (verbose) {\n          console.log(`  ${name}`)\n          console.log(`    ${tool.description}`)\n          if (tool.requiredFeatures?.length) {\n            console.log(`    Requires: ${tool.requiredFeatures.join(', ')}`)\n          }\n        } else {\n          console.log(`  - ${name}`)\n        }\n      }\n      console.log('')\n    }\n  },\n}\n\nconst entityGraph: ModuleCli = {\n  command: 'entity-graph',\n  async run(rest) {\n    const args = parseArgs(rest)\n    const format = String(args.format ?? 'triples') as 'json' | 'triples'\n    const entity = args.entity ? String(args.entity) : undefined\n    const module = args.module ? String(args.module) : undefined\n\n    await ensureBootstrap()\n\n    const { getOrm } = await import('@open-mercato/shared/lib/db/mikro')\n    const { extractEntityGraph, formatGraphAsTriples, filterGraphByEntity, filterGraphByModule } = await import(\n      './lib/entity-graph'\n    )\n\n    console.log('[Entity Graph] Extracting from MikroORM metadata...')\n\n    const orm = await getOrm()\n    const graph = await extractEntityGraph(orm)\n\n    // Apply filters\n    let edges = graph.edges\n\n    if (entity) {\n      edges = filterGraphByEntity(graph, entity)\n      console.log(`[Entity Graph] Filtered by entity: ${entity}`)\n    }\n\n    if (module) {\n      const filteredGraph = { ...graph, edges }\n      edges = filterGraphByModule(filteredGraph, module)\n      console.log(`[Entity Graph] Filtered by module: ${module}`)\n    }\n\n    const filteredGraph = { ...graph, edges }\n\n    if (format === 'json') {\n      console.log(JSON.stringify(filteredGraph, null, 2))\n    } else {\n      const triples = formatGraphAsTriples(filteredGraph)\n      console.log('')\n      for (const triple of triples) {\n        console.log(triple)\n      }\n    }\n\n    console.log(`\\n[Entity Graph] ${graph.nodes.length} entities, ${edges.length} relationships`)\n  },\n}\n\nconst runPendingActionCleanup: ModuleCli = {\n  command: 'run-pending-action-cleanup',\n  async run() {\n    await ensureBootstrap()\n    const container = await createRequestContainer()\n\n    const { runPendingActionCleanup: runCleanup } = await import(\n      './workers/ai-pending-action-cleanup'\n    )\n\n    const em = container.resolve<import('@mikro-orm/postgresql').EntityManager>('em')\n    const summary = await runCleanup({ em })\n\n    console.log('[ai-pending-action-cleanup] Sweep complete:', summary)\n  },\n}\n\nconst testTools: ModuleCli = {\n  command: 'test-tools',\n  async run(rest) {\n    const args = parseArgs(rest)\n    const json = args.json === true || args.json === 'true'\n    const moduleFilter =\n      typeof args.module === 'string' && args.module.length > 0 ? args.module : null\n    const includeMutations = args['no-mutations'] !== true && args['no-mutations'] !== 'true'\n    const tenantId =\n      typeof args.tenant === 'string' && args.tenant.length > 0 ? args.tenant : null\n    const organizationId =\n      typeof args.org === 'string' && args.org.length > 0 ? args.org : null\n\n    await ensureBootstrap()\n    const { runToolTests } = await import('./lib/tool-test-runner')\n    const report = await runToolTests({\n      tenantId,\n      organizationId,\n      moduleFilter,\n      includeMutations,\n    })\n\n    if (json) {\n      // Wrap in markers so a Playwright spec (or any caller) can extract the\n      // JSON payload without being thrown off by bootstrap log lines emitted\n      // to stdout by other modules during DI container creation.\n      console.log('---TOOL_TEST_REPORT_BEGIN---')\n      console.log(JSON.stringify(report))\n      console.log('---TOOL_TEST_REPORT_END---')\n    } else {\n      console.log('')\n      console.log(\n        `AI tool test report \u2014 tenant=${report.tenantId ?? '<none>'} org=${\n          report.organizationId ?? '<none>'\n        }`,\n      )\n      console.log(\n        `total=${report.total} pass=${report.passed} fail=${report.failed} skip=${report.skipped}`,\n      )\n      const byModule = new Map<string, typeof report.records>()\n      for (const record of report.records) {\n        const list = byModule.get(record.module) ?? []\n        list.push(record)\n        byModule.set(record.module, list)\n      }\n      const sortedModules = Array.from(byModule.keys()).sort((a, b) => (a < b ? -1 : a > b ? 1 : 0))\n      for (const moduleId of sortedModules) {\n        const list = byModule.get(moduleId)!\n        console.log('')\n        console.log(`${moduleId} (${list.length}):`)\n        for (const record of list) {\n          const marker =\n            record.status === 'pass' ? '\u2713' : record.status === 'fail' ? '\u2717' : '\u00B7'\n          const reason = record.reason ? ` \u2014 ${record.reason}` : ''\n          const mutation = record.isMutation ? ' [mutation]' : ''\n          console.log(\n            `  ${marker} ${record.tool}${mutation} (${record.durationMs}ms)${reason}`,\n          )\n        }\n      }\n      console.log('')\n    }\n\n    if (report.failed > 0) {\n      process.exitCode = 1\n    }\n  },\n}\n\nconst runTokenUsagePrune: ModuleCli = {\n  command: 'run-token-usage-prune',\n  async run() {\n    await ensureBootstrap()\n    const container = await createRequestContainer()\n\n    const { runTokenUsagePrune: runPrune } = await import(\n      './workers/ai-token-usage-prune'\n    )\n\n    const em = container.resolve<import('@mikro-orm/postgresql').EntityManager>('em')\n    const summary = await runPrune({ em })\n\n    console.log('[ai-token-usage-prune] Prune complete:', summary)\n  },\n}\n\nexport default [\n  mcpServe,\n  mcpServeHttp,\n  mcpDev,\n  listTools,\n  entityGraph,\n  runPendingActionCleanup,\n  runTokenUsagePrune,\n  testTools,\n]\n"],
-  "mappings": "AACA,SAAS,8BAA8B;AACvC,SAAS,8BAA8B;AAMvC,eAAe,kBAAiC;AAE9C,MAAI;AACF,UAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,uCAAuC;AAChF,oBAAgB;AAChB;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,MAAI;AACF,UAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,kDAAkD;AAChG,UAAM,qBAAqB;AAAA,EAC7B,SAAS,OAAO;AACd,YAAQ,MAAM,2BAA2B,iBAAiB,QAAQ,MAAM,UAAU,KAAK;AAAA,EAEzF;AACF;AAEA,SAAS,UAAU,MAAkD;AACnE,QAAM,OAAyC,CAAC;AAChD,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,MAAM,KAAK,CAAC;AAClB,QAAI,CAAC,KAAK,WAAW,IAAI,EAAG;AAE5B,UAAM,CAAC,KAAK,KAAK,IAAI,IAAI,QAAQ,OAAO,EAAE,EAAE,MAAM,GAAG;AACrD,QAAI,UAAU,QAAW;AACvB,WAAK,GAAG,IAAI;AAAA,IACd,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,EAAG,WAAW,IAAI,GAAG;AACxD,WAAK,GAAG,IAAI,KAAK,IAAI,CAAC;AACtB;AAAA,IACF,OAAO;AACL,WAAK,GAAG,IAAI;AAAA,IACd;AAAA,EACF;AACA,SAAO;AACT;AAEA,MAAM,WAAsB;AAAA,EAC1B,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AAGd,YAAQ,IAAI,qBAAqB;AACjC,2BAAuB;AACvB,UAAM,OAAO,UAAU,IAAI;AAI3B,UAAM,SAAS,OAAO,KAAK,SAAS,KAAK,KAAK,UAAU,EAAE,KAAK,QAAQ,IAAI,wBAAwB;AACnG,UAAM,WAAW,OAAO,KAAK,UAAU,KAAK,YAAY,EAAE,KAAK;AAC/D,UAAM,iBAAiB,OAAO,KAAK,OAAO,KAAK,kBAAkB,EAAE,KAAK;AACxE,UAAM,SAAS,OAAO,KAAK,QAAQ,KAAK,UAAU,EAAE,KAAK;AACzD,UAAM,QAAQ,KAAK,UAAU,QAAQ,KAAK,UAAU;AACpD,UAAM,iCACJ,KAAK,kCAAkC,MAAM,QAC7C,KAAK,kCAAkC,MAAM;AAG/C,QAAI,CAAC,UAAU,CAAC,UAAU;AACxB,cAAQ,MAAM,iDAAiD;AAC/D,cAAQ,MAAM,EAAE;AAChB,cAAQ,MAAM,8BAA8B;AAC5C,cAAQ,MAAM,4FAAuF;AACrG,cAAQ,MAAM,8FAA8F;AAC5G,cAAQ,MAAM,6DAA6D;AAC3E,cAAQ,MAAM,EAAE;AAChB,cAAQ,MAAM,0BAA0B;AACxC,cAAQ,MAAM,mDAAmD;AACjE,cAAQ,MAAM,oGAAoG;AAClH,cAAQ,MAAM,EAAE;AAChB,cAAQ,MAAM,iBAAiB;AAC/B,cAAQ,MAAM,6CAA6C;AAC3D,cAAQ,MAAM,sCAAsC;AACpD,cAAQ,MAAM,mFAAmF;AACjG,cAAQ,MAAM,2FAA2F;AACzG,cAAQ,MAAM,EAAE;AAChB,cAAQ,MAAM,WAAW;AACzB,cAAQ,MAAM,wEAAwE;AACtF,cAAQ,MAAM,6DAA6D;AAC3E,cAAQ,MAAM,iGAAiG;AAC/G,cAAQ,MAAM,mHAAmH;AACjI;AAAA,IACF;AAEA,UAAM,gBAAgB;AACtB,UAAM,YAAY,MAAM,uBAAuB;AAE/C,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,kBAAkB;AAExD,QAAI,QAAQ;AACV,YAAM,aAAa;AAAA,QACjB,QAAQ;AAAA,UACN,MAAM;AAAA,UACN,SAAS;AAAA,UACT;AAAA,QACF;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB,CAAC;AAAA,IACH,OAAO;AACL,YAAM,aAAa;AAAA,QACjB,QAAQ;AAAA,UACN,MAAM;AAAA,UACN,SAAS;AAAA,UACT;AAAA,QACF;AAAA,QACA;AAAA,QACA,SAAS;AAAA,UACP;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,MAAM,mBAAmB;AAEzB,MAAM,eAA0B;AAAA,EAC9B,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAAO,UAAU,IAAI;AAC3B,UAAM,UAAU,SAAS,OAAO,KAAK,QAAQ,EAAE,GAAG,EAAE;AACpD,UAAM,OAAO,CAAC,WAAW,MAAM,OAAO,IAAI,mBAAmB;AAC7D,UAAM,QAAQ,KAAK,UAAU,QAAQ,KAAK,UAAU;AAEpD,UAAM,gBAAgB;AACtB,UAAM,YAAY,MAAM,uBAAuB;AAE/C,UAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,mBAAmB;AAE7D,UAAM,iBAAiB;AAAA,MACrB,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,SAAS;AAAA,QACT;AAAA,MACF;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEA,MAAM,SAAoB;AAAA,EACxB,SAAS;AAAA,EACT,MAAM,MAAM;AACV,UAAM,gBAAgB;AACtB,UAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,sBAAsB;AAC/D,UAAM,gBAAgB;AAAA,EACxB;AACF;AAEA,MAAM,YAAuB;AAAA,EAC3B,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAAO,UAAU,IAAI;AAC3B,UAAM,UAAU,KAAK,YAAY,QAAQ,KAAK,YAAY;AAG1D,UAAM,gBAAgB;AAEtB,UAAM,EAAE,mBAAmB,IAAI,MAAM,OAAO,mBAAmB;AAC/D,UAAM,mBAAmB;AAEzB,UAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,qBAAqB;AAC9D,UAAM,WAAW,gBAAgB;AACjC,UAAM,YAAY,SAAS,cAAc;AAEzC,QAAI,UAAU,WAAW,GAAG;AAC1B,cAAQ,IAAI,4BAA4B;AACxC,cAAQ,IAAI,+DAA+D;AAC3E;AAAA,IACF;AAEA,YAAQ,IAAI;AAAA,wBAA2B,UAAU,MAAM;AAAA,CAAM;AAG7D,UAAM,WAAW,oBAAI,IAAsB;AAC3C,eAAW,QAAQ,WAAW;AAC5B,YAAM,CAAC,MAAM,IAAI,KAAK,MAAM,GAAG;AAC/B,YAAM,OAAO,SAAS,IAAI,MAAM,KAAK,CAAC;AACtC,WAAK,KAAK,IAAI;AACd,eAAS,IAAI,QAAQ,IAAI;AAAA,IAC3B;AAGA,UAAM,gBAAgB,MAAM,KAAK,SAAS,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,MAAO,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAE;AAE7F,eAAW,UAAU,eAAe;AAClC,YAAM,QAAQ,SAAS,IAAI,MAAM;AACjC,cAAQ,IAAI,GAAG,MAAM,KAAK,MAAM,MAAM,UAAU;AAEhD,iBAAW,QAAQ,MAAM,KAAK,CAAC,GAAG,MAAO,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAE,GAAG;AACrE,cAAM,OAAO,SAAS,QAAQ,IAAI;AAClC,YAAI,CAAC,KAAM;AAEX,YAAI,SAAS;AACX,kBAAQ,IAAI,KAAK,IAAI,EAAE;AACvB,kBAAQ,IAAI,OAAO,KAAK,WAAW,EAAE;AACrC,cAAI,KAAK,kBAAkB,QAAQ;AACjC,oBAAQ,IAAI,iBAAiB,KAAK,iBAAiB,KAAK,IAAI,CAAC,EAAE;AAAA,UACjE;AAAA,QACF,OAAO;AACL,kBAAQ,IAAI,OAAO,IAAI,EAAE;AAAA,QAC3B;AAAA,MACF;AACA,cAAQ,IAAI,EAAE;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,cAAyB;AAAA,EAC7B,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAAO,UAAU,IAAI;AAC3B,UAAM,SAAS,OAAO,KAAK,UAAU,SAAS;AAC9C,UAAM,SAAS,KAAK,SAAS,OAAO,KAAK,MAAM,IAAI;AACnD,UAAM,SAAS,KAAK,SAAS,OAAO,KAAK,MAAM,IAAI;AAEnD,UAAM,gBAAgB;AAEtB,UAAM,EAAE,OAAO,IAAI,MAAM,OAAO,mCAAmC;AACnE,UAAM,EAAE,oBAAoB,sBAAsB,qBAAqB,oBAAoB,IAAI,MAAM,OACnG,oBACF;AAEA,YAAQ,IAAI,qDAAqD;AAEjE,UAAM,MAAM,MAAM,OAAO;AACzB,UAAM,QAAQ,MAAM,mBAAmB,GAAG;AAG1C,QAAI,QAAQ,MAAM;AAElB,QAAI,QAAQ;AACV,cAAQ,oBAAoB,OAAO,MAAM;AACzC,cAAQ,IAAI,sCAAsC,MAAM,EAAE;AAAA,IAC5D;AAEA,QAAI,QAAQ;AACV,YAAMA,iBAAgB,EAAE,GAAG,OAAO,MAAM;AACxC,cAAQ,oBAAoBA,gBAAe,MAAM;AACjD,cAAQ,IAAI,sCAAsC,MAAM,EAAE;AAAA,IAC5D;AAEA,UAAM,gBAAgB,EAAE,GAAG,OAAO,MAAM;AAExC,QAAI,WAAW,QAAQ;AACrB,cAAQ,IAAI,KAAK,UAAU,eAAe,MAAM,CAAC,CAAC;AAAA,IACpD,OAAO;AACL,YAAM,UAAU,qBAAqB,aAAa;AAClD,cAAQ,IAAI,EAAE;AACd,iBAAW,UAAU,SAAS;AAC5B,gBAAQ,IAAI,MAAM;AAAA,MACpB;AAAA,IACF;AAEA,YAAQ,IAAI;AAAA,iBAAoB,MAAM,MAAM,MAAM,cAAc,MAAM,MAAM,gBAAgB;AAAA,EAC9F;AACF;AAEA,MAAM,0BAAqC;AAAA,EACzC,SAAS;AAAA,EACT,MAAM,MAAM;AACV,UAAM,gBAAgB;AACtB,UAAM,YAAY,MAAM,uBAAuB;AAE/C,UAAM,EAAE,yBAAyB,WAAW,IAAI,MAAM,OACpD,qCACF;AAEA,UAAM,KAAK,UAAU,QAAuD,IAAI;AAChF,UAAM,UAAU,MAAM,WAAW,EAAE,GAAG,CAAC;AAEvC,YAAQ,IAAI,+CAA+C,OAAO;AAAA,EACpE;AACF;AAEA,MAAM,YAAuB;AAAA,EAC3B,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAAO,UAAU,IAAI;AAC3B,UAAM,OAAO,KAAK,SAAS,QAAQ,KAAK,SAAS;AACjD,UAAM,eACJ,OAAO,KAAK,WAAW,YAAY,KAAK,OAAO,SAAS,IAAI,KAAK,SAAS;AAC5E,UAAM,mBAAmB,KAAK,cAAc,MAAM,QAAQ,KAAK,cAAc,MAAM;AACnF,UAAM,WACJ,OAAO,KAAK,WAAW,YAAY,KAAK,OAAO,SAAS,IAAI,KAAK,SAAS;AAC5E,UAAM,iBACJ,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,SAAS,IAAI,KAAK,MAAM;AAEnE,UAAM,gBAAgB;AACtB,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,wBAAwB;AAC9D,UAAM,SAAS,MAAM,aAAa;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAED,QAAI,MAAM;AAIR,cAAQ,IAAI,8BAA8B;AAC1C,cAAQ,IAAI,KAAK,UAAU,MAAM,CAAC;AAClC,cAAQ,IAAI,4BAA4B;AAAA,IAC1C,OAAO;AACL,cAAQ,IAAI,EAAE;AACd,cAAQ;AAAA,QACN,qCAAgC,OAAO,YAAY,QAAQ,QACzD,OAAO,kBAAkB,QAC3B;AAAA,MACF;AACA,cAAQ;AAAA,QACN,SAAS,OAAO,KAAK,SAAS,OAAO,MAAM,SAAS,OAAO,MAAM,SAAS,OAAO,OAAO;AAAA,MAC1F;AACA,YAAM,WAAW,oBAAI,IAAmC;AACxD,iBAAW,UAAU,OAAO,SAAS;AACnC,cAAM,OAAO,SAAS,IAAI,OAAO,MAAM,KAAK,CAAC;AAC7C,aAAK,KAAK,MAAM;AAChB,iBAAS,IAAI,OAAO,QAAQ,IAAI;AAAA,MAClC;AACA,YAAM,gBAAgB,MAAM,KAAK,SAAS,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,MAAO,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAE;AAC7F,iBAAW,YAAY,eAAe;AACpC,cAAM,OAAO,SAAS,IAAI,QAAQ;AAClC,gBAAQ,IAAI,EAAE;AACd,gBAAQ,IAAI,GAAG,QAAQ,KAAK,KAAK,MAAM,IAAI;AAC3C,mBAAW,UAAU,MAAM;AACzB,gBAAM,SACJ,OAAO,WAAW,SAAS,WAAM,OAAO,WAAW,SAAS,WAAM;AACpE,gBAAM,SAAS,OAAO,SAAS,WAAM,OAAO,MAAM,KAAK;AACvD,gBAAM,WAAW,OAAO,aAAa,gBAAgB;AACrD,kBAAQ;AAAA,YACN,KAAK,MAAM,IAAI,OAAO,IAAI,GAAG,QAAQ,KAAK,OAAO,UAAU,MAAM,MAAM;AAAA,UACzE;AAAA,QACF;AAAA,MACF;AACA,cAAQ,IAAI,EAAE;AAAA,IAChB;AAEA,QAAI,OAAO,SAAS,GAAG;AACrB,cAAQ,WAAW;AAAA,IACrB;AAAA,EACF;AACF;AAEA,MAAM,qBAAgC;AAAA,EACpC,SAAS;AAAA,EACT,MAAM,MAAM;AACV,UAAM,gBAAgB;AACtB,UAAM,YAAY,MAAM,uBAAuB;AAE/C,UAAM,EAAE,oBAAoB,SAAS,IAAI,MAAM,OAC7C,gCACF;AAEA,UAAM,KAAK,UAAU,QAAuD,IAAI;AAChF,UAAM,UAAU,MAAM,SAAS,EAAE,GAAG,CAAC;AAErC,YAAQ,IAAI,0CAA0C,OAAO;AAAA,EAC/D;AACF;AAEA,IAAO,cAAQ;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;",
+  "sourcesContent": ["import type { ModuleCli } from '@open-mercato/shared/modules/registry'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { resetServerLoggerCache } from '@open-mercato/shared/lib/logger'\n/**\n * Ensure app bootstrap is called before creating DI container.\n * Uses the shared generated-bootstrap loader so the command works both from\n * the monorepo app and from standalone apps installed through npm packages.\n */\nasync function ensureBootstrap(): Promise<void> {\n  // First check if DI is already available\n  try {\n    const { getDiRegistrars } = await import('@open-mercato/shared/lib/di/container')\n    getDiRegistrars()\n    return // DI already available\n  } catch {\n    // DI not available, need to bootstrap\n  }\n\n  try {\n    const { bootstrapFromAppRoot } = await import('@open-mercato/shared/lib/bootstrap/dynamicLoader')\n    await bootstrapFromAppRoot()\n  } catch (error) {\n    console.error('[MCP] Bootstrap failed:', error instanceof Error ? error.message : error)\n    // Continue - some contexts may not have bootstrap available\n  }\n}\n\nfunction parseArgs(rest: string[]): Record<string, string | boolean> {\n  const args: Record<string, string | boolean> = {}\n  for (let i = 0; i < rest.length; i++) {\n    const arg = rest[i]\n    if (!arg?.startsWith('--')) continue\n\n    const [key, value] = arg.replace(/^--/, '').split('=')\n    if (value !== undefined) {\n      args[key] = value\n    } else if (rest[i + 1] && !rest[i + 1]!.startsWith('--')) {\n      args[key] = rest[i + 1]!\n      i++\n    } else {\n      args[key] = true\n    }\n  }\n  return args\n}\n\nconst mcpServe: ModuleCli = {\n  command: 'mcp:serve',\n  async run(rest) {\n    // stdout carries the MCP JSON-RPC protocol (StdioServerTransport) \u2014 route all\n    // facade logs to stderr and rebuild any pino root created earlier in this process.\n    process.env.OM_LOG_DESTINATION = 'stderr'\n    resetServerLoggerCache()\n    const args = parseArgs(rest)\n    // Prefer the OPEN_MERCATO_API_KEY env var so the secret never has to be\n    // placed on the command line (argv is world-readable via ps / /proc).\n    // The --api-key flag stays supported for backward compatibility.\n    const apiKey = String(args['api-key'] ?? args.apiKey ?? '') || process.env.OPEN_MERCATO_API_KEY || null\n    const tenantId = String(args.tenant ?? args.tenantId ?? '') || null\n    const organizationId = String(args.org ?? args.organizationId ?? '') || null\n    const userId = String(args.user ?? args.userId ?? '') || null\n    const debug = args.debug === true || args.debug === 'true'\n    const allowUnauthenticatedSuperadmin =\n      args['allow-unauthenticated-superadmin'] === true ||\n      args['allow-unauthenticated-superadmin'] === 'true'\n\n    // Either API key or tenant is required\n    if (!apiKey && !tenantId) {\n      console.error('Usage: mercato ai_assistant mcp:serve [options]')\n      console.error('')\n      console.error('Authentication (choose one):')\n      console.error('  OPEN_MERCATO_API_KEY env   API key secret (recommended \u2014 keeps the secret off argv)')\n      console.error('  --api-key <secret>         API key secret for authentication (visible in process listings)')\n      console.error('  --tenant <id>              Tenant ID (for manual context)')\n      console.error('')\n      console.error('Options (with --tenant):')\n      console.error('  --org <id>           Organization ID (optional)')\n      console.error('  --user <id>          User ID for ACL (required unless --allow-unauthenticated-superadmin is set)')\n      console.error('')\n      console.error('Common options:')\n      console.error('  --debug              Enable debug logging')\n      console.error('  --allow-unauthenticated-superadmin')\n      console.error('                       DEV/TEST ONLY: run as superadmin with no per-user ACL when')\n      console.error('                       no --user (and no --api-key) is supplied. Never use in production.')\n      console.error('')\n      console.error('Examples:')\n      console.error('  OPEN_MERCATO_API_KEY=omk_xxxx.yyyy... mercato ai_assistant mcp:serve')\n      console.error('  mercato ai_assistant mcp:serve --api-key omk_xxxx.yyyy...')\n      console.error('  mercato ai_assistant mcp:serve --tenant 123e4567-e89b-12d3-a456-426614174000 --user <user-id>')\n      console.error('  mercato ai_assistant mcp:serve --tenant 123e4567-e89b-12d3-a456-426614174000 --allow-unauthenticated-superadmin')\n      return\n    }\n\n    await ensureBootstrap()\n    const container = await createRequestContainer()\n\n    const { runMcpServer } = await import('./lib/mcp-server')\n\n    if (apiKey) {\n      await runMcpServer({\n        config: {\n          name: 'open-mercato-mcp',\n          version: '0.1.0',\n          debug,\n        },\n        container,\n        apiKeySecret: apiKey,\n      })\n    } else {\n      await runMcpServer({\n        config: {\n          name: 'open-mercato-mcp',\n          version: '0.1.0',\n          debug,\n        },\n        container,\n        context: {\n          tenantId,\n          organizationId,\n          userId,\n        },\n        allowUnauthenticatedSuperadmin,\n      })\n    }\n  },\n}\n\nconst MCP_DEFAULT_PORT = 3001\n\nconst mcpServeHttp: ModuleCli = {\n  command: 'mcp:serve-http',\n  async run(rest) {\n    const args = parseArgs(rest)\n    const portArg = parseInt(String(args.port ?? ''), 10)\n    const port = !portArg || isNaN(portArg) ? MCP_DEFAULT_PORT : portArg\n    const debug = args.debug === true || args.debug === 'true'\n\n    await ensureBootstrap()\n    const container = await createRequestContainer()\n\n    const { runMcpHttpServer } = await import('./lib/http-server')\n\n    await runMcpHttpServer({\n      config: {\n        name: 'open-mercato-mcp',\n        version: '0.1.0',\n        debug,\n      },\n      container,\n      port,\n    })\n  },\n}\n\nconst mcpDev: ModuleCli = {\n  command: 'mcp:dev',\n  async run() {\n    await ensureBootstrap()\n    const { runMcpDevServer } = await import('./lib/mcp-dev-server')\n    await runMcpDevServer()\n  },\n}\n\nconst mcpEnsureApiKey: ModuleCli = {\n  command: 'mcp:ensure-api-key',\n  async run(rest) {\n    const args = parseArgs(rest)\n    // A bare `--file` (no value) parses to boolean true \u2014 treat it as missing\n    // rather than provisioning into a file literally named \"true\".\n    const fileArg = typeof args.file === 'string' ? args.file.trim() : ''\n    const filePath =\n      fileArg || process.env.MCP_SERVER_API_KEY_FILE?.trim() || process.env.MCP_API_KEY_FILE?.trim() || ''\n    if (!filePath) {\n      console.error('Usage: mercato ai_assistant mcp:ensure-api-key --file <path> [options]')\n      console.error('')\n      console.error('Ensures a valid MCP server API key exists in the database and that its')\n      console.error('plaintext secret is stored in <path> (the idempotency anchor). The secret')\n      console.error('is never printed; consumers such as the OpenCode container read the file.')\n      console.error('')\n      console.error('Options:')\n      console.error('  --file <path>    Secret file path (or MCP_SERVER_API_KEY_FILE env)')\n      console.error('  --name <name>    API key name (default __mcp_server__)')\n      console.error('  --email <email>  Owner user email (default OM_INIT_SUPERADMIN_EMAIL, then superadmin@acme.com)')\n      console.error('  --rotate         Force rotation even when the file secret is still valid')\n      process.exitCode = 1\n      return\n    }\n\n    const keyName = typeof args.name === 'string' && args.name.length > 0 ? args.name : undefined\n    const ownerEmail = typeof args.email === 'string' && args.email.length > 0 ? args.email : undefined\n    const rotate = args.rotate === true || args.rotate === 'true'\n\n    await ensureBootstrap()\n    const container = await createRequestContainer()\n    const em = container.resolve<import('@mikro-orm/postgresql').EntityManager>('em')\n    const rbac = container.resolve('rbacService') as import('@open-mercato/core/modules/auth/services/rbacService').RbacService\n\n    const { ensureMcpApiKey } = await import('./lib/mcp-ensure-api-key')\n    const result = await ensureMcpApiKey({ em, filePath, keyName, ownerEmail, rotate, rbac })\n    const message = result.status === 'valid' ? 'Existing key is valid' : 'New key created'\n    console.log(`[mcp:ensure-api-key] ${message} (id=${result.keyId}, prefix=${result.keyPrefix})`)\n  },\n}\n\nconst listTools: ModuleCli = {\n  command: 'mcp:list-tools',\n  async run(rest) {\n    const args = parseArgs(rest)\n    const verbose = args.verbose === true || args.verbose === 'true'\n\n    // Ensure bootstrap runs so modules are registered for API discovery\n    await ensureBootstrap()\n\n    const { loadAllModuleTools } = await import('./lib/tool-loader')\n    await loadAllModuleTools()\n\n    const { getToolRegistry } = await import('./lib/tool-registry')\n    const registry = getToolRegistry()\n    const toolNames = registry.listToolNames()\n\n    if (toolNames.length === 0) {\n      console.log('\\nNo MCP tools registered.')\n      console.log('Tools can be registered by modules using registerMcpTool().\\n')\n      return\n    }\n\n    console.log(`\\nRegistered MCP Tools (${toolNames.length}):\\n`)\n\n    // Group tools by module\n    const byModule = new Map<string, string[]>()\n    for (const name of toolNames) {\n      const [module] = name.split('.')\n      const list = byModule.get(module) ?? []\n      list.push(name)\n      byModule.set(module, list)\n    }\n\n    // Sort modules alphabetically\n    const sortedModules = Array.from(byModule.keys()).sort((a, b) => (a < b ? -1 : a > b ? 1 : 0))\n\n    for (const module of sortedModules) {\n      const tools = byModule.get(module)!\n      console.log(`${module} (${tools.length} tools):`)\n\n      for (const name of tools.sort((a, b) => (a < b ? -1 : a > b ? 1 : 0))) {\n        const tool = registry.getTool(name)\n        if (!tool) continue\n\n        if (verbose) {\n          console.log(`  ${name}`)\n          console.log(`    ${tool.description}`)\n          if (tool.requiredFeatures?.length) {\n            console.log(`    Requires: ${tool.requiredFeatures.join(', ')}`)\n          }\n        } else {\n          console.log(`  - ${name}`)\n        }\n      }\n      console.log('')\n    }\n  },\n}\n\nconst entityGraph: ModuleCli = {\n  command: 'entity-graph',\n  async run(rest) {\n    const args = parseArgs(rest)\n    const format = String(args.format ?? 'triples') as 'json' | 'triples'\n    const entity = args.entity ? String(args.entity) : undefined\n    const module = args.module ? String(args.module) : undefined\n\n    await ensureBootstrap()\n\n    const { getOrm } = await import('@open-mercato/shared/lib/db/mikro')\n    const { extractEntityGraph, formatGraphAsTriples, filterGraphByEntity, filterGraphByModule } = await import(\n      './lib/entity-graph'\n    )\n\n    console.log('[Entity Graph] Extracting from MikroORM metadata...')\n\n    const orm = await getOrm()\n    const graph = await extractEntityGraph(orm)\n\n    // Apply filters\n    let edges = graph.edges\n\n    if (entity) {\n      edges = filterGraphByEntity(graph, entity)\n      console.log(`[Entity Graph] Filtered by entity: ${entity}`)\n    }\n\n    if (module) {\n      const filteredGraph = { ...graph, edges }\n      edges = filterGraphByModule(filteredGraph, module)\n      console.log(`[Entity Graph] Filtered by module: ${module}`)\n    }\n\n    const filteredGraph = { ...graph, edges }\n\n    if (format === 'json') {\n      console.log(JSON.stringify(filteredGraph, null, 2))\n    } else {\n      const triples = formatGraphAsTriples(filteredGraph)\n      console.log('')\n      for (const triple of triples) {\n        console.log(triple)\n      }\n    }\n\n    console.log(`\\n[Entity Graph] ${graph.nodes.length} entities, ${edges.length} relationships`)\n  },\n}\n\nconst runPendingActionCleanup: ModuleCli = {\n  command: 'run-pending-action-cleanup',\n  async run() {\n    await ensureBootstrap()\n    const container = await createRequestContainer()\n\n    const { runPendingActionCleanup: runCleanup } = await import(\n      './workers/ai-pending-action-cleanup'\n    )\n\n    const em = container.resolve<import('@mikro-orm/postgresql').EntityManager>('em')\n    const summary = await runCleanup({ em })\n\n    console.log('[ai-pending-action-cleanup] Sweep complete:', summary)\n  },\n}\n\nconst testTools: ModuleCli = {\n  command: 'test-tools',\n  async run(rest) {\n    const args = parseArgs(rest)\n    const json = args.json === true || args.json === 'true'\n    const moduleFilter =\n      typeof args.module === 'string' && args.module.length > 0 ? args.module : null\n    const includeMutations = args['no-mutations'] !== true && args['no-mutations'] !== 'true'\n    const tenantId =\n      typeof args.tenant === 'string' && args.tenant.length > 0 ? args.tenant : null\n    const organizationId =\n      typeof args.org === 'string' && args.org.length > 0 ? args.org : null\n\n    await ensureBootstrap()\n    const { runToolTests } = await import('./lib/tool-test-runner')\n    const report = await runToolTests({\n      tenantId,\n      organizationId,\n      moduleFilter,\n      includeMutations,\n    })\n\n    if (json) {\n      // Wrap in markers so a Playwright spec (or any caller) can extract the\n      // JSON payload without being thrown off by bootstrap log lines emitted\n      // to stdout by other modules during DI container creation.\n      console.log('---TOOL_TEST_REPORT_BEGIN---')\n      console.log(JSON.stringify(report))\n      console.log('---TOOL_TEST_REPORT_END---')\n    } else {\n      console.log('')\n      console.log(\n        `AI tool test report \u2014 tenant=${report.tenantId ?? '<none>'} org=${\n          report.organizationId ?? '<none>'\n        }`,\n      )\n      console.log(\n        `total=${report.total} pass=${report.passed} fail=${report.failed} skip=${report.skipped}`,\n      )\n      const byModule = new Map<string, typeof report.records>()\n      for (const record of report.records) {\n        const list = byModule.get(record.module) ?? []\n        list.push(record)\n        byModule.set(record.module, list)\n      }\n      const sortedModules = Array.from(byModule.keys()).sort((a, b) => (a < b ? -1 : a > b ? 1 : 0))\n      for (const moduleId of sortedModules) {\n        const list = byModule.get(moduleId)!\n        console.log('')\n        console.log(`${moduleId} (${list.length}):`)\n        for (const record of list) {\n          const marker =\n            record.status === 'pass' ? '\u2713' : record.status === 'fail' ? '\u2717' : '\u00B7'\n          const reason = record.reason ? ` \u2014 ${record.reason}` : ''\n          const mutation = record.isMutation ? ' [mutation]' : ''\n          console.log(\n            `  ${marker} ${record.tool}${mutation} (${record.durationMs}ms)${reason}`,\n          )\n        }\n      }\n      console.log('')\n    }\n\n    if (report.failed > 0) {\n      process.exitCode = 1\n    }\n  },\n}\n\nconst runTokenUsagePrune: ModuleCli = {\n  command: 'run-token-usage-prune',\n  async run() {\n    await ensureBootstrap()\n    const container = await createRequestContainer()\n\n    const { runTokenUsagePrune: runPrune } = await import(\n      './workers/ai-token-usage-prune'\n    )\n\n    const em = container.resolve<import('@mikro-orm/postgresql').EntityManager>('em')\n    const summary = await runPrune({ em })\n\n    console.log('[ai-token-usage-prune] Prune complete:', summary)\n  },\n}\n\nexport default [\n  mcpServe,\n  mcpServeHttp,\n  mcpDev,\n  mcpEnsureApiKey,\n  listTools,\n  entityGraph,\n  runPendingActionCleanup,\n  runTokenUsagePrune,\n  testTools,\n]\n"],
+  "mappings": "AACA,SAAS,8BAA8B;AACvC,SAAS,8BAA8B;AAMvC,eAAe,kBAAiC;AAE9C,MAAI;AACF,UAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,uCAAuC;AAChF,oBAAgB;AAChB;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,MAAI;AACF,UAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,kDAAkD;AAChG,UAAM,qBAAqB;AAAA,EAC7B,SAAS,OAAO;AACd,YAAQ,MAAM,2BAA2B,iBAAiB,QAAQ,MAAM,UAAU,KAAK;AAAA,EAEzF;AACF;AAEA,SAAS,UAAU,MAAkD;AACnE,QAAM,OAAyC,CAAC;AAChD,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,MAAM,KAAK,CAAC;AAClB,QAAI,CAAC,KAAK,WAAW,IAAI,EAAG;AAE5B,UAAM,CAAC,KAAK,KAAK,IAAI,IAAI,QAAQ,OAAO,EAAE,EAAE,MAAM,GAAG;AACrD,QAAI,UAAU,QAAW;AACvB,WAAK,GAAG,IAAI;AAAA,IACd,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,EAAG,WAAW,IAAI,GAAG;AACxD,WAAK,GAAG,IAAI,KAAK,IAAI,CAAC;AACtB;AAAA,IACF,OAAO;AACL,WAAK,GAAG,IAAI;AAAA,IACd;AAAA,EACF;AACA,SAAO;AACT;AAEA,MAAM,WAAsB;AAAA,EAC1B,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AAGd,YAAQ,IAAI,qBAAqB;AACjC,2BAAuB;AACvB,UAAM,OAAO,UAAU,IAAI;AAI3B,UAAM,SAAS,OAAO,KAAK,SAAS,KAAK,KAAK,UAAU,EAAE,KAAK,QAAQ,IAAI,wBAAwB;AACnG,UAAM,WAAW,OAAO,KAAK,UAAU,KAAK,YAAY,EAAE,KAAK;AAC/D,UAAM,iBAAiB,OAAO,KAAK,OAAO,KAAK,kBAAkB,EAAE,KAAK;AACxE,UAAM,SAAS,OAAO,KAAK,QAAQ,KAAK,UAAU,EAAE,KAAK;AACzD,UAAM,QAAQ,KAAK,UAAU,QAAQ,KAAK,UAAU;AACpD,UAAM,iCACJ,KAAK,kCAAkC,MAAM,QAC7C,KAAK,kCAAkC,MAAM;AAG/C,QAAI,CAAC,UAAU,CAAC,UAAU;AACxB,cAAQ,MAAM,iDAAiD;AAC/D,cAAQ,MAAM,EAAE;AAChB,cAAQ,MAAM,8BAA8B;AAC5C,cAAQ,MAAM,4FAAuF;AACrG,cAAQ,MAAM,8FAA8F;AAC5G,cAAQ,MAAM,6DAA6D;AAC3E,cAAQ,MAAM,EAAE;AAChB,cAAQ,MAAM,0BAA0B;AACxC,cAAQ,MAAM,mDAAmD;AACjE,cAAQ,MAAM,oGAAoG;AAClH,cAAQ,MAAM,EAAE;AAChB,cAAQ,MAAM,iBAAiB;AAC/B,cAAQ,MAAM,6CAA6C;AAC3D,cAAQ,MAAM,sCAAsC;AACpD,cAAQ,MAAM,mFAAmF;AACjG,cAAQ,MAAM,2FAA2F;AACzG,cAAQ,MAAM,EAAE;AAChB,cAAQ,MAAM,WAAW;AACzB,cAAQ,MAAM,wEAAwE;AACtF,cAAQ,MAAM,6DAA6D;AAC3E,cAAQ,MAAM,iGAAiG;AAC/G,cAAQ,MAAM,mHAAmH;AACjI;AAAA,IACF;AAEA,UAAM,gBAAgB;AACtB,UAAM,YAAY,MAAM,uBAAuB;AAE/C,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,kBAAkB;AAExD,QAAI,QAAQ;AACV,YAAM,aAAa;AAAA,QACjB,QAAQ;AAAA,UACN,MAAM;AAAA,UACN,SAAS;AAAA,UACT;AAAA,QACF;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB,CAAC;AAAA,IACH,OAAO;AACL,YAAM,aAAa;AAAA,QACjB,QAAQ;AAAA,UACN,MAAM;AAAA,UACN,SAAS;AAAA,UACT;AAAA,QACF;AAAA,QACA;AAAA,QACA,SAAS;AAAA,UACP;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,MAAM,mBAAmB;AAEzB,MAAM,eAA0B;AAAA,EAC9B,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAAO,UAAU,IAAI;AAC3B,UAAM,UAAU,SAAS,OAAO,KAAK,QAAQ,EAAE,GAAG,EAAE;AACpD,UAAM,OAAO,CAAC,WAAW,MAAM,OAAO,IAAI,mBAAmB;AAC7D,UAAM,QAAQ,KAAK,UAAU,QAAQ,KAAK,UAAU;AAEpD,UAAM,gBAAgB;AACtB,UAAM,YAAY,MAAM,uBAAuB;AAE/C,UAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,mBAAmB;AAE7D,UAAM,iBAAiB;AAAA,MACrB,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,SAAS;AAAA,QACT;AAAA,MACF;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEA,MAAM,SAAoB;AAAA,EACxB,SAAS;AAAA,EACT,MAAM,MAAM;AACV,UAAM,gBAAgB;AACtB,UAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,sBAAsB;AAC/D,UAAM,gBAAgB;AAAA,EACxB;AACF;AAEA,MAAM,kBAA6B;AAAA,EACjC,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAAO,UAAU,IAAI;AAG3B,UAAM,UAAU,OAAO,KAAK,SAAS,WAAW,KAAK,KAAK,KAAK,IAAI;AACnE,UAAM,WACJ,WAAW,QAAQ,IAAI,yBAAyB,KAAK,KAAK,QAAQ,IAAI,kBAAkB,KAAK,KAAK;AACpG,QAAI,CAAC,UAAU;AACb,cAAQ,MAAM,wEAAwE;AACtF,cAAQ,MAAM,EAAE;AAChB,cAAQ,MAAM,wEAAwE;AACtF,cAAQ,MAAM,2EAA2E;AACzF,cAAQ,MAAM,2EAA2E;AACzF,cAAQ,MAAM,EAAE;AAChB,cAAQ,MAAM,UAAU;AACxB,cAAQ,MAAM,sEAAsE;AACpF,cAAQ,MAAM,0DAA0D;AACxE,cAAQ,MAAM,kGAAkG;AAChH,cAAQ,MAAM,4EAA4E;AAC1F,cAAQ,WAAW;AACnB;AAAA,IACF;AAEA,UAAM,UAAU,OAAO,KAAK,SAAS,YAAY,KAAK,KAAK,SAAS,IAAI,KAAK,OAAO;AACpF,UAAM,aAAa,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,SAAS,IAAI,KAAK,QAAQ;AAC1F,UAAM,SAAS,KAAK,WAAW,QAAQ,KAAK,WAAW;AAEvD,UAAM,gBAAgB;AACtB,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAuD,IAAI;AAChF,UAAM,OAAO,UAAU,QAAQ,aAAa;AAE5C,UAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,0BAA0B;AACnE,UAAM,SAAS,MAAM,gBAAgB,EAAE,IAAI,UAAU,SAAS,YAAY,QAAQ,KAAK,CAAC;AACxF,UAAM,UAAU,OAAO,WAAW,UAAU,0BAA0B;AACtE,YAAQ,IAAI,wBAAwB,OAAO,QAAQ,OAAO,KAAK,YAAY,OAAO,SAAS,GAAG;AAAA,EAChG;AACF;AAEA,MAAM,YAAuB;AAAA,EAC3B,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAAO,UAAU,IAAI;AAC3B,UAAM,UAAU,KAAK,YAAY,QAAQ,KAAK,YAAY;AAG1D,UAAM,gBAAgB;AAEtB,UAAM,EAAE,mBAAmB,IAAI,MAAM,OAAO,mBAAmB;AAC/D,UAAM,mBAAmB;AAEzB,UAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,qBAAqB;AAC9D,UAAM,WAAW,gBAAgB;AACjC,UAAM,YAAY,SAAS,cAAc;AAEzC,QAAI,UAAU,WAAW,GAAG;AAC1B,cAAQ,IAAI,4BAA4B;AACxC,cAAQ,IAAI,+DAA+D;AAC3E;AAAA,IACF;AAEA,YAAQ,IAAI;AAAA,wBAA2B,UAAU,MAAM;AAAA,CAAM;AAG7D,UAAM,WAAW,oBAAI,IAAsB;AAC3C,eAAW,QAAQ,WAAW;AAC5B,YAAM,CAAC,MAAM,IAAI,KAAK,MAAM,GAAG;AAC/B,YAAM,OAAO,SAAS,IAAI,MAAM,KAAK,CAAC;AACtC,WAAK,KAAK,IAAI;AACd,eAAS,IAAI,QAAQ,IAAI;AAAA,IAC3B;AAGA,UAAM,gBAAgB,MAAM,KAAK,SAAS,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,MAAO,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAE;AAE7F,eAAW,UAAU,eAAe;AAClC,YAAM,QAAQ,SAAS,IAAI,MAAM;AACjC,cAAQ,IAAI,GAAG,MAAM,KAAK,MAAM,MAAM,UAAU;AAEhD,iBAAW,QAAQ,MAAM,KAAK,CAAC,GAAG,MAAO,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAE,GAAG;AACrE,cAAM,OAAO,SAAS,QAAQ,IAAI;AAClC,YAAI,CAAC,KAAM;AAEX,YAAI,SAAS;AACX,kBAAQ,IAAI,KAAK,IAAI,EAAE;AACvB,kBAAQ,IAAI,OAAO,KAAK,WAAW,EAAE;AACrC,cAAI,KAAK,kBAAkB,QAAQ;AACjC,oBAAQ,IAAI,iBAAiB,KAAK,iBAAiB,KAAK,IAAI,CAAC,EAAE;AAAA,UACjE;AAAA,QACF,OAAO;AACL,kBAAQ,IAAI,OAAO,IAAI,EAAE;AAAA,QAC3B;AAAA,MACF;AACA,cAAQ,IAAI,EAAE;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,cAAyB;AAAA,EAC7B,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAAO,UAAU,IAAI;AAC3B,UAAM,SAAS,OAAO,KAAK,UAAU,SAAS;AAC9C,UAAM,SAAS,KAAK,SAAS,OAAO,KAAK,MAAM,IAAI;AACnD,UAAM,SAAS,KAAK,SAAS,OAAO,KAAK,MAAM,IAAI;AAEnD,UAAM,gBAAgB;AAEtB,UAAM,EAAE,OAAO,IAAI,MAAM,OAAO,mCAAmC;AACnE,UAAM,EAAE,oBAAoB,sBAAsB,qBAAqB,oBAAoB,IAAI,MAAM,OACnG,oBACF;AAEA,YAAQ,IAAI,qDAAqD;AAEjE,UAAM,MAAM,MAAM,OAAO;AACzB,UAAM,QAAQ,MAAM,mBAAmB,GAAG;AAG1C,QAAI,QAAQ,MAAM;AAElB,QAAI,QAAQ;AACV,cAAQ,oBAAoB,OAAO,MAAM;AACzC,cAAQ,IAAI,sCAAsC,MAAM,EAAE;AAAA,IAC5D;AAEA,QAAI,QAAQ;AACV,YAAMA,iBAAgB,EAAE,GAAG,OAAO,MAAM;AACxC,cAAQ,oBAAoBA,gBAAe,MAAM;AACjD,cAAQ,IAAI,sCAAsC,MAAM,EAAE;AAAA,IAC5D;AAEA,UAAM,gBAAgB,EAAE,GAAG,OAAO,MAAM;AAExC,QAAI,WAAW,QAAQ;AACrB,cAAQ,IAAI,KAAK,UAAU,eAAe,MAAM,CAAC,CAAC;AAAA,IACpD,OAAO;AACL,YAAM,UAAU,qBAAqB,aAAa;AAClD,cAAQ,IAAI,EAAE;AACd,iBAAW,UAAU,SAAS;AAC5B,gBAAQ,IAAI,MAAM;AAAA,MACpB;AAAA,IACF;AAEA,YAAQ,IAAI;AAAA,iBAAoB,MAAM,MAAM,MAAM,cAAc,MAAM,MAAM,gBAAgB;AAAA,EAC9F;AACF;AAEA,MAAM,0BAAqC;AAAA,EACzC,SAAS;AAAA,EACT,MAAM,MAAM;AACV,UAAM,gBAAgB;AACtB,UAAM,YAAY,MAAM,uBAAuB;AAE/C,UAAM,EAAE,yBAAyB,WAAW,IAAI,MAAM,OACpD,qCACF;AAEA,UAAM,KAAK,UAAU,QAAuD,IAAI;AAChF,UAAM,UAAU,MAAM,WAAW,EAAE,GAAG,CAAC;AAEvC,YAAQ,IAAI,+CAA+C,OAAO;AAAA,EACpE;AACF;AAEA,MAAM,YAAuB;AAAA,EAC3B,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAAO,UAAU,IAAI;AAC3B,UAAM,OAAO,KAAK,SAAS,QAAQ,KAAK,SAAS;AACjD,UAAM,eACJ,OAAO,KAAK,WAAW,YAAY,KAAK,OAAO,SAAS,IAAI,KAAK,SAAS;AAC5E,UAAM,mBAAmB,KAAK,cAAc,MAAM,QAAQ,KAAK,cAAc,MAAM;AACnF,UAAM,WACJ,OAAO,KAAK,WAAW,YAAY,KAAK,OAAO,SAAS,IAAI,KAAK,SAAS;AAC5E,UAAM,iBACJ,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,SAAS,IAAI,KAAK,MAAM;AAEnE,UAAM,gBAAgB;AACtB,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,wBAAwB;AAC9D,UAAM,SAAS,MAAM,aAAa;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAED,QAAI,MAAM;AAIR,cAAQ,IAAI,8BAA8B;AAC1C,cAAQ,IAAI,KAAK,UAAU,MAAM,CAAC;AAClC,cAAQ,IAAI,4BAA4B;AAAA,IAC1C,OAAO;AACL,cAAQ,IAAI,EAAE;AACd,cAAQ;AAAA,QACN,qCAAgC,OAAO,YAAY,QAAQ,QACzD,OAAO,kBAAkB,QAC3B;AAAA,MACF;AACA,cAAQ;AAAA,QACN,SAAS,OAAO,KAAK,SAAS,OAAO,MAAM,SAAS,OAAO,MAAM,SAAS,OAAO,OAAO;AAAA,MAC1F;AACA,YAAM,WAAW,oBAAI,IAAmC;AACxD,iBAAW,UAAU,OAAO,SAAS;AACnC,cAAM,OAAO,SAAS,IAAI,OAAO,MAAM,KAAK,CAAC;AAC7C,aAAK,KAAK,MAAM;AAChB,iBAAS,IAAI,OAAO,QAAQ,IAAI;AAAA,MAClC;AACA,YAAM,gBAAgB,MAAM,KAAK,SAAS,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,MAAO,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAE;AAC7F,iBAAW,YAAY,eAAe;AACpC,cAAM,OAAO,SAAS,IAAI,QAAQ;AAClC,gBAAQ,IAAI,EAAE;AACd,gBAAQ,IAAI,GAAG,QAAQ,KAAK,KAAK,MAAM,IAAI;AAC3C,mBAAW,UAAU,MAAM;AACzB,gBAAM,SACJ,OAAO,WAAW,SAAS,WAAM,OAAO,WAAW,SAAS,WAAM;AACpE,gBAAM,SAAS,OAAO,SAAS,WAAM,OAAO,MAAM,KAAK;AACvD,gBAAM,WAAW,OAAO,aAAa,gBAAgB;AACrD,kBAAQ;AAAA,YACN,KAAK,MAAM,IAAI,OAAO,IAAI,GAAG,QAAQ,KAAK,OAAO,UAAU,MAAM,MAAM;AAAA,UACzE;AAAA,QACF;AAAA,MACF;AACA,cAAQ,IAAI,EAAE;AAAA,IAChB;AAEA,QAAI,OAAO,SAAS,GAAG;AACrB,cAAQ,WAAW;AAAA,IACrB;AAAA,EACF;AACF;AAEA,MAAM,qBAAgC;AAAA,EACpC,SAAS;AAAA,EACT,MAAM,MAAM;AACV,UAAM,gBAAgB;AACtB,UAAM,YAAY,MAAM,uBAAuB;AAE/C,UAAM,EAAE,oBAAoB,SAAS,IAAI,MAAM,OAC7C,gCACF;AAEA,UAAM,KAAK,UAAU,QAAuD,IAAI;AAChF,UAAM,UAAU,MAAM,SAAS,EAAE,GAAG,CAAC;AAErC,YAAQ,IAAI,0CAA0C,OAAO;AAAA,EAC/D;AACF;AAEA,IAAO,cAAQ;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;",
   "names": ["filteredGraph"]
 }

package/dist/modules/ai_assistant/lib/mcp-ensure-api-key.js

@@ -0,0 +1,89 @@
+import { promises as fs } from "node:fs";
+import { dirname } from "node:path";
+import { ApiKey } from "@open-mercato/core/modules/api_keys/data/entities";
+import {
+  createApiKey,
+  deleteApiKey,
+  findApiKeyBySecret
+} from "@open-mercato/core/modules/api_keys/services/apiKeyService";
+import { User } from "@open-mercato/core/modules/auth/data/entities";
+import { emailHashLookupValues } from "@open-mercato/core/modules/auth/lib/emailHash";
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { getUserRoleIds } from "./user-role-ids.js";
+const DEFAULT_MCP_KEY_NAME = "__mcp_server__";
+const DEFAULT_MCP_KEY_OWNER_EMAIL = "superadmin@acme.com";
+async function readSecretFile(filePath) {
+  try {
+    const raw = await fs.readFile(filePath, "utf8");
+    const trimmed = raw.trim();
+    return trimmed.length > 0 ? trimmed : null;
+  } catch {
+    return null;
+  }
+}
+async function writeSecretFile(filePath, secret) {
+  await fs.mkdir(dirname(filePath), { recursive: true });
+  const tmpPath = `${filePath}.tmp`;
+  await fs.writeFile(tmpPath, `${secret}
+`, { mode: 420 });
+  await fs.rename(tmpPath, filePath);
+  await fs.chmod(filePath, 420);
+}
+async function ensureMcpApiKey(options) {
+  const keyName = options.keyName?.trim() || DEFAULT_MCP_KEY_NAME;
+  const existingSecret = await readSecretFile(options.filePath);
+  if (existingSecret && existingSecret.startsWith("omk_") && !options.rotate) {
+    const existingKey = await findApiKeyBySecret(options.em, existingSecret);
+    if (existingKey && existingKey.name === keyName) {
+      return { status: "valid", keyId: existingKey.id, keyPrefix: existingKey.keyPrefix };
+    }
+  }
+  const ownerEmail = options.ownerEmail?.trim() || process.env.OM_INIT_SUPERADMIN_EMAIL?.trim() || DEFAULT_MCP_KEY_OWNER_EMAIL;
+  const owner = await findOneWithDecryption(
+    options.em,
+    User,
+    {
+      deletedAt: null,
+      $or: [
+        { email: ownerEmail },
+        { emailHash: { $in: emailHashLookupValues(ownerEmail) } }
+      ]
+    },
+    {},
+    { tenantId: null, organizationId: null }
+  );
+  if (!owner) {
+    throw new Error(
+      `[internal] MCP API key owner not found: no active user with email "${ownerEmail}". Run "mercato init" first or pass --email pointing at an existing admin user.`
+    );
+  }
+  const roleIds = await getUserRoleIds(options.em, owner.id, owner.tenantId ?? null);
+  const staleKeys = await options.em.find(ApiKey, {
+    name: keyName,
+    tenantId: owner.tenantId ?? null,
+    deletedAt: null
+  });
+  for (const staleKey of staleKeys) {
+    await deleteApiKey(options.em, staleKey.id, { rbac: options.rbac });
+  }
+  const { record, secret } = await createApiKey(
+    options.em,
+    {
+      name: keyName,
+      description: "MCP server key provisioned by mcp:ensure-api-key",
+      tenantId: owner.tenantId ?? null,
+      organizationId: null,
+      roles: roleIds,
+      createdBy: owner.id
+    },
+    { rbac: options.rbac }
+  );
+  await writeSecretFile(options.filePath, secret);
+  return { status: "created", keyId: record.id, keyPrefix: record.keyPrefix };
+}
+export {
+  DEFAULT_MCP_KEY_NAME,
+  DEFAULT_MCP_KEY_OWNER_EMAIL,
+  ensureMcpApiKey
+};
+//# sourceMappingURL=mcp-ensure-api-key.js.map

package/dist/modules/ai_assistant/lib/mcp-ensure-api-key.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/ai_assistant/lib/mcp-ensure-api-key.ts"],
+  "sourcesContent": ["import { promises as fs } from 'node:fs'\nimport { dirname } from 'node:path'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { ApiKey } from '@open-mercato/core/modules/api_keys/data/entities'\nimport {\n  createApiKey,\n  deleteApiKey,\n  findApiKeyBySecret,\n} from '@open-mercato/core/modules/api_keys/services/apiKeyService'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport { emailHashLookupValues } from '@open-mercato/core/modules/auth/lib/emailHash'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { getUserRoleIds } from './user-role-ids'\n\nexport const DEFAULT_MCP_KEY_NAME = '__mcp_server__'\nexport const DEFAULT_MCP_KEY_OWNER_EMAIL = 'superadmin@acme.com'\n\nexport type EnsureMcpApiKeyOptions = {\n  em: EntityManager\n  filePath: string\n  keyName?: string\n  ownerEmail?: string\n  rotate?: boolean\n  rbac?: RbacService\n}\n\nexport type EnsureMcpApiKeyResult = {\n  status: 'valid' | 'created'\n  keyId: string\n  keyPrefix: string\n}\n\nasync function readSecretFile(filePath: string): Promise<string | null> {\n  try {\n    const raw = await fs.readFile(filePath, 'utf8')\n    const trimmed = raw.trim()\n    return trimmed.length > 0 ? trimmed : null\n  } catch {\n    return null\n  }\n}\n\nasync function writeSecretFile(filePath: string, secret: string): Promise<void> {\n  await fs.mkdir(dirname(filePath), { recursive: true })\n  const tmpPath = `${filePath}.tmp`\n  // World-readable on purpose: the file lives in a dedicated named volume\n  // mounted only into this stack's containers, and the consumer (the OpenCode\n  // container) runs as a non-root user that cannot read a root-owned 0600\n  // file. The volume boundary, not the file mode, is the security boundary.\n  await fs.writeFile(tmpPath, `${secret}\\n`, { mode: 0o644 })\n  await fs.rename(tmpPath, filePath)\n  await fs.chmod(filePath, 0o644)\n}\n\n/**\n * Ensure a valid MCP server API key exists and its plaintext secret is stored\n * in `filePath`. The DB only holds a bcrypt hash, so the secret file is the\n * idempotency anchor: when it still resolves to a live key of the expected\n * name, nothing changes. Otherwise stale keys with that name are soft-deleted\n * and a fresh key is created, owned by the superadmin user so header-only MCP\n * calls resolve an ACL context via `createdBy`.\n */\nexport async function ensureMcpApiKey(options: EnsureMcpApiKeyOptions): Promise<EnsureMcpApiKeyResult> {\n  const keyName = options.keyName?.trim() || DEFAULT_MCP_KEY_NAME\n  const existingSecret = await readSecretFile(options.filePath)\n\n  if (existingSecret && existingSecret.startsWith('omk_') && !options.rotate) {\n    const existingKey = await findApiKeyBySecret(options.em, existingSecret)\n    if (existingKey && existingKey.name === keyName) {\n      return { status: 'valid', keyId: existingKey.id, keyPrefix: existingKey.keyPrefix }\n    }\n  }\n\n  const ownerEmail =\n    options.ownerEmail?.trim() ||\n    process.env.OM_INIT_SUPERADMIN_EMAIL?.trim() ||\n    DEFAULT_MCP_KEY_OWNER_EMAIL\n  // User.email is encrypted at rest with an email_hash lookup column, and\n  // findOneWithDecryption does not rewrite filters \u2014 a plaintext { email }\n  // match would find nothing once encryption is on. Mirror the $or pattern\n  // from AuthService.findUserByEmail so both modes resolve the owner.\n  const owner = await findOneWithDecryption(\n    options.em,\n    User,\n    {\n      deletedAt: null,\n      $or: [\n        { email: ownerEmail },\n        { emailHash: { $in: emailHashLookupValues(ownerEmail) } },\n      ],\n    },\n    {},\n    { tenantId: null, organizationId: null },\n  )\n  if (!owner) {\n    throw new Error(\n      `[internal] MCP API key owner not found: no active user with email \"${ownerEmail}\". ` +\n        'Run \"mercato init\" first or pass --email pointing at an existing admin user.',\n    )\n  }\n\n  const roleIds = await getUserRoleIds(options.em, owner.id, owner.tenantId ?? null)\n\n  // Scope the cleanup to the owner's tenant: keys with the same name in other\n  // tenants belong to other stacks/tenants and must never be revoked here.\n  const staleKeys = await options.em.find(ApiKey, {\n    name: keyName,\n    tenantId: owner.tenantId ?? null,\n    deletedAt: null,\n  })\n  for (const staleKey of staleKeys) {\n    await deleteApiKey(options.em, staleKey.id, { rbac: options.rbac })\n  }\n\n  const { record, secret } = await createApiKey(\n    options.em,\n    {\n      name: keyName,\n      description: 'MCP server key provisioned by mcp:ensure-api-key',\n      tenantId: owner.tenantId ?? null,\n      organizationId: null,\n      roles: roleIds,\n      createdBy: owner.id,\n    },\n    { rbac: options.rbac },\n  )\n\n  await writeSecretFile(options.filePath, secret)\n\n  return { status: 'created', keyId: record.id, keyPrefix: record.keyPrefix }\n}\n"],
+  "mappings": "AAAA,SAAS,YAAY,UAAU;AAC/B,SAAS,eAAe;AAGxB,SAAS,cAAc;AACvB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,YAAY;AACrB,SAAS,6BAA6B;AACtC,SAAS,6BAA6B;AACtC,SAAS,sBAAsB;AAExB,MAAM,uBAAuB;AAC7B,MAAM,8BAA8B;AAiB3C,eAAe,eAAe,UAA0C;AACtE,MAAI;AACF,UAAM,MAAM,MAAM,GAAG,SAAS,UAAU,MAAM;AAC9C,UAAM,UAAU,IAAI,KAAK;AACzB,WAAO,QAAQ,SAAS,IAAI,UAAU;AAAA,EACxC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,gBAAgB,UAAkB,QAA+B;AAC9E,QAAM,GAAG,MAAM,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AACrD,QAAM,UAAU,GAAG,QAAQ;AAK3B,QAAM,GAAG,UAAU,SAAS,GAAG,MAAM;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AAC1D,QAAM,GAAG,OAAO,SAAS,QAAQ;AACjC,QAAM,GAAG,MAAM,UAAU,GAAK;AAChC;AAUA,eAAsB,gBAAgB,SAAiE;AACrG,QAAM,UAAU,QAAQ,SAAS,KAAK,KAAK;AAC3C,QAAM,iBAAiB,MAAM,eAAe,QAAQ,QAAQ;AAE5D,MAAI,kBAAkB,eAAe,WAAW,MAAM,KAAK,CAAC,QAAQ,QAAQ;AAC1E,UAAM,cAAc,MAAM,mBAAmB,QAAQ,IAAI,cAAc;AACvE,QAAI,eAAe,YAAY,SAAS,SAAS;AAC/C,aAAO,EAAE,QAAQ,SAAS,OAAO,YAAY,IAAI,WAAW,YAAY,UAAU;AAAA,IACpF;AAAA,EACF;AAEA,QAAM,aACJ,QAAQ,YAAY,KAAK,KACzB,QAAQ,IAAI,0BAA0B,KAAK,KAC3C;AAKF,QAAM,QAAQ,MAAM;AAAA,IAClB,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,MACE,WAAW;AAAA,MACX,KAAK;AAAA,QACH,EAAE,OAAO,WAAW;AAAA,QACpB,EAAE,WAAW,EAAE,KAAK,sBAAsB,UAAU,EAAE,EAAE;AAAA,MAC1D;AAAA,IACF;AAAA,IACA,CAAC;AAAA,IACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC;AACA,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR,sEAAsE,UAAU;AAAA,IAElF;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,eAAe,QAAQ,IAAI,MAAM,IAAI,MAAM,YAAY,IAAI;AAIjF,QAAM,YAAY,MAAM,QAAQ,GAAG,KAAK,QAAQ;AAAA,IAC9C,MAAM;AAAA,IACN,UAAU,MAAM,YAAY;AAAA,IAC5B,WAAW;AAAA,EACb,CAAC;AACD,aAAW,YAAY,WAAW;AAChC,UAAM,aAAa,QAAQ,IAAI,SAAS,IAAI,EAAE,MAAM,QAAQ,KAAK,CAAC;AAAA,EACpE;AAEA,QAAM,EAAE,QAAQ,OAAO,IAAI,MAAM;AAAA,IAC/B,QAAQ;AAAA,IACR;AAAA,MACE,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU,MAAM,YAAY;AAAA,MAC5B,gBAAgB;AAAA,MAChB,OAAO;AAAA,MACP,WAAW,MAAM;AAAA,IACnB;AAAA,IACA,EAAE,MAAM,QAAQ,KAAK;AAAA,EACvB;AAEA,QAAM,gBAAgB,QAAQ,UAAU,MAAM;AAE9C,SAAO,EAAE,QAAQ,WAAW,OAAO,OAAO,IAAI,WAAW,OAAO,UAAU;AAC5E;",
+  "names": []
+}

package/dist/modules/ai_assistant/lib/user-role-ids.js

@@ -0,0 +1,18 @@
+import { UserRole } from "@open-mercato/core/modules/auth/data/entities";
+import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+async function getUserRoleIds(em, userId, tenantId) {
+  if (!tenantId) return [];
+  const links = await findWithDecryption(
+    em,
+    UserRole,
+    { user: userId, role: { tenantId } },
+    { populate: ["role"] },
+    { tenantId, organizationId: null }
+  );
+  const linkList = Array.isArray(links) ? links : [];
+  return linkList.map((link) => link.role?.id).filter((id) => typeof id === "string" && id.length > 0);
+}
+export {
+  getUserRoleIds
+};
+//# sourceMappingURL=user-role-ids.js.map

package/dist/modules/ai_assistant/lib/user-role-ids.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/ai_assistant/lib/user-role-ids.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { UserRole } from '@open-mercato/core/modules/auth/data/entities'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\n/**\n * Resolve a user's role ids for the given tenant.\n *\n * Single source for every AI-assistant surface that mints a role-carrying\n * API key (the mcp-key and session-key routes, the chat route's ephemeral\n * session keys, and the mcp:ensure-api-key CLI), so all of those keys\n * inherit exactly the same ACL for the same user.\n */\nexport async function getUserRoleIds(\n  em: EntityManager,\n  userId: string,\n  tenantId: string | null,\n): Promise<string[]> {\n  if (!tenantId) return []\n  const links = await findWithDecryption(\n    em,\n    UserRole,\n    { user: userId, role: { tenantId } },\n    { populate: ['role'] },\n    { tenantId, organizationId: null },\n  )\n  const linkList = Array.isArray(links) ? links : []\n  return linkList\n    .map((link) => link.role?.id)\n    .filter((id): id is string => typeof id === 'string' && id.length > 0)\n}\n"],
+  "mappings": "AACA,SAAS,gBAAgB;AACzB,SAAS,0BAA0B;AAUnC,eAAsB,eACpB,IACA,QACA,UACmB;AACnB,MAAI,CAAC,SAAU,QAAO,CAAC;AACvB,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA,EAAE,MAAM,QAAQ,MAAM,EAAE,SAAS,EAAE;AAAA,IACnC,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,IACrB,EAAE,UAAU,gBAAgB,KAAK;AAAA,EACnC;AACA,QAAM,WAAW,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC;AACjD,SAAO,SACJ,IAAI,CAAC,SAAS,KAAK,MAAM,EAAE,EAC3B,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AACzE;",
+  "names": []
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/ai-assistant",
-  "version": "0.6.6-develop.6540.1.ae856df1ec",
+  "version": "0.6.6-develop.6541.1.c6f8fa5d2b",
   "license": "MIT",
   "type": "module",
   "engines": {
@@ -99,16 +99,16 @@
     "zod-to-json-schema": "^3.25.2"
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.6.6-develop.6540.1.ae856df1ec",
-    "@open-mercato/ui": "0.6.6-develop.6540.1.ae856df1ec",
+    "@open-mercato/shared": "0.6.6-develop.6541.1.c6f8fa5d2b",
+    "@open-mercato/ui": "0.6.6-develop.6541.1.c6f8fa5d2b",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
     "zod": ">=3.23.0"
   },
   "devDependencies": {
-    "@open-mercato/cli": "0.6.6-develop.6540.1.ae856df1ec",
-    "@open-mercato/shared": "0.6.6-develop.6540.1.ae856df1ec",
-    "@open-mercato/ui": "0.6.6-develop.6540.1.ae856df1ec",
+    "@open-mercato/cli": "0.6.6-develop.6541.1.c6f8fa5d2b",
+    "@open-mercato/shared": "0.6.6-develop.6541.1.c6f8fa5d2b",
+    "@open-mercato/ui": "0.6.6-develop.6541.1.c6f8fa5d2b",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
     "react": "19.2.7",

package/src/modules/ai_assistant/api/chat/route.ts

@@ -16,9 +16,8 @@ import {
   bindOpencodeSessionToApiKey,
   findApiKeyByOpencodeSessionId,
 } from '@open-mercato/core/modules/api_keys/services/apiKeyService'
-import { UserRole } from '@open-mercato/core/modules/auth/data/entities'
-import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { checkAiChatRateLimit } from '../../lib/rate-limit'
+import { getUserRoleIds } from '../../lib/user-role-ids'
 
 const logger = createLogger('ai_assistant')
 
@@ -139,29 +138,6 @@ export const metadata = {
   POST: { requireAuth: true, requireFeatures: ['ai_assistant.view'] },
 }
 
-/**
- * Get user's role IDs from the database.
- */
-async function getUserRoleIds(
-  em: EntityManager,
-  userId: string,
-  tenantId: string | null
-): Promise<string[]> {
-  if (!tenantId) return []
-
-  const links = await findWithDecryption(
-    em,
-    UserRole,
-    { user: userId as any, role: { tenantId } } as any,
-    { populate: ['role'] },
-    { tenantId, organizationId: null },
-  )
-  const linkList = Array.isArray(links) ? links : []
-  return linkList
-    .map((l) => (l.role as any)?.id)
-    .filter((id): id is string => typeof id === 'string' && id.length > 0)
-}
-
 /**
  * Chat endpoint that routes messages to OpenCode agent.
  * OpenCode connects to MCP server for tool access (search, execute, context_whoami).